Also include the command to set a password, if they wish.
This includes the tmpfiles config to link the various WSL-provided service sockets to the expected location. It also includes an override snippet for systemd-firstboot to have it not run inside WSL for the present as it hangs forever.
Zbyszek noted global is preferred to define in a review comment.
