[wue] add option to Disable BitLocker automatic device encryption

* See https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-bitlocker#disable-bitlocker-automatic-device-encryption
* Closes #2121