Refers to #77

KSPP has added them to the recommendations.

Refers to #74.

Currently GrapheneOS doesn't have it.

The corresponding checks have been developed.

1. Don't add an exception to normalize_cmdline_options() since strtobool()
is used for kpti

2. Use new '0' check of 'is not off'

The default value for the 'mitigations' option is 'auto'.

So this option should be enabled ('is not off') or not set at all.

This check gives FAIL if the option value is 'off' or
the option is not found. In other cases this check gives OK.

This feature is needed for checking that the CPU vulnerability mitigations
are not disabled. Let's see how it works and maybe improve it in future.