bug#68968: system reconfigure ignores incorrect --on-error flag value

[Michal Atlas <michal_atlas+gnu@posteo.net>]

In the guix/scripts/system.scm file we do not check the value while parsing the flag:

--8<---------------cut here---------------start------------->8---
(option '("on-error") #t #f
         (lambda (opt name arg result)
           (alist-cons 'on-error (string->symbol arg)
                       result)))
--8<---------------cut here---------------end--------------->8---

and then blindly pass it to load*:

--8<---------------cut here---------------start------------->8---
(load* file %user-module
        #:on-error (assoc-ref opts 'on-error))
--8<---------------cut here---------------end--------------->8---

and load* uses it in a case that only gets called when an actual error occurs and treats the correct symbols but has a default clause that silently ignores values other than debug and backtrace:

--8<---------------cut here---------------start------------->8---
(case on-error
   ((debug)
    ...)
   ((backtrace)
    ...)
   (else
    #t))
--8<---------------cut here---------------end--------------->8---

meaning that for example a typo such as `--on-error=stacktrace`, gets treated as if the flag was not passed at all.

Minimum replication:
--8<---------------cut here---------------start------------->8---
guix system build <(echo x) --on-error=stacktrace
guix system build <(echo x) --on-error=backtrace
--8<---------------cut here---------------end--------------->8---

I'm not sure where the check should be done, nor what would be an acceptable way to not duplicate the list of valid values between guix/ui.scm and guix/scripts/system.scm