sysusers: add new ! line flag for creating fully locked accounts

Fixes: #13522

man/sysusers.d.xml

@@ -93,9 +93,9 @@ r     -          lowest-highest</programlisting>
     field description, home directory, and login shell:</para>
 
     <programlisting>#Type Name     ID             GECOS                 Home directory Shell
-u     httpd    404            "HTTP User"
-u     _authd   /usr/bin/authd "Authorization user"
-u     postgres -              "Postgresql Database" /var/lib/pgsql /usr/libexec/postgresdb
+u!    httpd    404            "HTTP User"
+u!    _authd   /usr/bin/authd "Authorization user"
+u!    postgres -              "Postgresql Database" /var/lib/pgsql /usr/libexec/postgresdb
 g     input    -              -
 m     _authd   input
 u     root     0              "Superuser"           /root          /bin/zsh
@@ -119,6 +119,12 @@ r     -        500-900
           bearing the same name unless the ID field specifies it. The account will be
           created disabled, so that logins are not allowed.</para>
 
+          <para>Type <varname>u</varname> may be suffixed with an exclamation mark (<literal>u!</literal>) to
+          create a fully locked account. This is recommended, since logins should typically not be allowed
+          for system users. With or without the exclamation mark an invalid password is set. For
+          <literal>u!</literal>, the account is also locked, which makes a difference for non-password forms
+          of authentication, such as SSH or similar.</para>
+
           <xi:include href="version-info.xml" xpointer="v215"/></listitem>
         </varlistentry>