README: update for sha512 support

Use new kernel (5.3+) API for setting MBRDone flag alone

In older kernels, the only way to set MBRDone=y was to use
IOC_OPAL_ENABLE_DISABLE_MBR, which sets both MBREnabled and MBRDone
flags to the same value. In newer kernels we have IOC_OPAL_MBR_DONE,
which sets only MBRDone. This is way better (having no side effects),
but means sed-opal-unlocker now requires kernel 5.3+.

Fix MBRunshadow for newer kernels

Add ability to just decrypt password file

May be helpful with 2-stage initramfs, where first unlocks, and second
(eg. after kexec) does s3save.

Fix static build on glibc

Update README to reflect latest changes and features

Document and explain the project