Add ucode=scan to default Xen command line

Try to update microcode as early as possible if provided.
This option will scan all multiboot modules besides dom0 kernel. In our
case this is perfect - there is only one other module and it is
initramfs which have microcode early cpio prepended.

QubesOS/qubes-issues#3703

anaconda/pyanaconda/bootloader.py

@@ -1504,7 +1504,7 @@ class GRUB2(GRUB):
         # boot arguments
         log.info("bootloader.py: used boot args: %s ", self.boot_args)
         defaults.write("GRUB_CMDLINE_LINUX=\"%s\"\n" % self.boot_args)
-        defaults.write("GRUB_CMDLINE_XEN_DEFAULT=\"console=none dom0_mem=min:1024M dom0_mem=max:4096M iommu=no-igfx\"\n")
+        defaults.write("GRUB_CMDLINE_XEN_DEFAULT=\"console=none dom0_mem=min:1024M dom0_mem=max:4096M iommu=no-igfx ucode=scan\"\n")
         defaults.write("GRUB_DISABLE_RECOVERY=\"true\"\n")
         defaults.write("GRUB_THEME=\"/boot/grub2/themes/system/theme.txt\"\n")
         defaults.write("GRUB_DISABLE_OS_PROBER=\"true\"\n")
@@ -1892,7 +1892,7 @@ class XenEFI(EFIGRUB):
                 root_args += " rootflags=subvol=%s" % image.device.name
             config.write("\n")
             config.write("[{}]\n".format(image.version))
-            config.write("options=loglvl=all dom0_mem=min:1024M dom0_mem=max:4096M iommu=no-igfx\n")
+            config.write("options=loglvl=all dom0_mem=min:1024M dom0_mem=max:4096M iommu=no-igfx ucode=scan\n")
             config.write("kernel={} {} {}\n".format(
                 image.kernel,
                 root_args,