sysusers: optionally create fully locked accounts (#34876)

Let's ramp up security for system user accounts, at least where
possible, by creating them fully locked (instead of just with an invalid
password). This matters when taking non-password (i.e. SSH) logins into
account.

Fixes: #13522

test/units/TEST-74-AUX-UTILS.sysusers.sh

@@ -6,6 +6,17 @@ set -o pipefail
 # shellcheck source=test/units/util.sh
 . "$(dirname "$0")"/util.sh
 
+systemd-sysusers - <<EOF
+u unlockedtestuser - "An unlocked system user" / /bin/bash
+u! lockedtestuser - "A locked system user" / /bin/bash
+EOF
+
+userdbctl -j user unlockedtestuser
+userdbctl -j user lockedtestuser
+
+assert_eq "$(userdbctl -j user unlockedtestuser | jq .locked)" "null"
+assert_eq "$(userdbctl -j user lockedtestuser | jq .locked)" "true"
+
 at_exit() {
     set +e
     userdel -r foobarbaz