Potential fix for code scanning alert no. 1: Clear-text storage of sensitive information

[karlspace]

Potential fix for https://github.com/bauer-group/XPD-RPIImage/security/code-scanning/1

To fix this without changing overall functionality (users still get configured), stop embedding plaintext passwords in generated files. The best approach here is:

1. Accept only pre-hashed passwords in config (e.g., $6$... SHA-512 crypt format).
2. Generate chpasswd -e lines using the hash, not plaintext.
3. Reject non-hash values early with a clear error message.

In scripts/generate.py, update the user creation block around lines 453–474:

• Rename/read password field as hash (still from existing password key to avoid schema/functionality break).
• Validate it looks like a crypt hash (prefix $id$).
• Replace echo name:pw | chpasswd with echo name:hash | chpasswd -e.
• Remove the demo-password-expiry check tied to plaintext matching, since plaintext is no longer available in generator output.

No new imports are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.