Ensure nosuid option on /boot partition

Description

The nosuid mount option must be set on the /boot partition to prevent setuid programs from being executed from the boot filesystem.

Rationale

The /boot partition contains boot loader files and kernel images. Preventing setuid execution on /boot reduces the attack surface by ensuring no setuid programs can be run from the boot filesystem.

Framework references

Live verification