bug#68968: system reconfigure ignores incorrect --on-error flag value

[Michal Atlas]

In the guix/scripts/system.scm file we do not check the value while parsing the 
flag:

--8<---------------cut here---------------start------------->8---
(option '("on-error") #t #f
        (lambda (opt name arg result)
          (alist-cons 'on-error (string->symbol arg)
                      result)))
--8<---------------cut here---------------end--------------->8---

and then blindly pass it to load*:

--8<---------------cut here---------------start------------->8---
(load* file %user-module
       #:on-error (assoc-ref opts 'on-error))
--8<---------------cut here---------------end--------------->8---

and load* uses it in a case that only gets called when an actual error occurs 
and treats the correct symbols but has a default clause that silently ignores 
values other than debug and backtrace:

--8<---------------cut here---------------start------------->8---
(case on-error
  ((debug)
   ...)
  ((backtrace)
   ...)
  (else
   #t))
--8<---------------cut here---------------end--------------->8---

meaning that for example a typo such as `--on-error=stacktrace`, gets treated 
as if the flag was not passed at all.

Minimum replication:
--8<---------------cut here---------------start------------->8---
guix system build <(echo x) --on-error=stacktrace
guix system build <(echo x) --on-error=backtrace
--8<---------------cut here---------------end--------------->8---

I'm not sure where the check should be done, nor what would be an acceptable 
way to not duplicate the list of valid values between guix/ui.scm and 
guix/scripts/system.scm