Allow setting pbkdf algorithm for luks2 and default to argon2id

Some context: https://twitter.com/hipsterelectron/status/1648167820495142915, https://mjg59.dreamwidth.org/66429.html

pbkdf2 is not secure, and depending on how cryptmaster was compiled, luks2 could default to using that. Using a more secure default is probably the correct course of action.