During image mode updates, the %pre scriptlet changes to add clevis
to the tss group are overwritten by preserved host configuration.
Adding the group membership directly in the sysusers configuration
ensures it persists across image mode updates.
Resolves: #RHEL-132188
Signed-off-by: Sergio Arroutbi <sarroutb@redhat.com>
This tweaks the existing sysuser.d fragment in order to simplify it.
The 'nologin' shell is the documented systemd default, so there is
no need to explicitly specify it.
This change allows better handling of default vs custom shell in the
macro logic which bridges between `systemd-sysusers` and `useradd`.