Custom PAM rule for desktop login

[mbssrc]

Description of changes

This PR includes the following changes and fixes:

• remove fingerprint authentication from greetd as user home needs decryption
• re-ordering PAM modules on gtklock to unlock with either password or fingerprint, not requiring both
• add custom rule to require users to be in group video, preventing
  admin login on GUI. Still works for AGX/NX with createHome option.
• remove older 'desktop' group in favor of 'video'
• fix user creation script to disallow creating user duplicates
• fix user creation script to allow '-' characters in name
• move ollama persistent directory to service, removing failing ollama
  user/group setting, adding guard for launcher
• move XDG parameters from gui-vm to labc config

This should also fix SRCSP-5891. The user is now not asked for fingerprint
during login, which won't work as the home folder must be decrypted with key derived from users password.

Does not address multiple error messages when entering wrong password on lock-screen.

Checklist for things done

• Summary of the proposed changes in the PR description
• More detailed description in the commit message(s)
• Commits are squashed into relevant entities - avoid a lot of minimal dev time commits in the PR
• Contribution guidelines followed
• Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
• PR linked to architecture documentation and requirement(s) (ticket id)
• Test procedure described (or includes tests). Select one or more:
  • Tested on Lenovo X1 x86_64
  • Tested on Jetson Orin NX or AGX aarch64
  • Tested on Polarfire riscv64
• Author has run make-checks and it passes
• All automatic Github Action checks pass - see actions
• Author has added reviewers and removed PR draft status
• Change requires full re-installation
• Change can be updated with nixos-rebuild ... switch

Tested on x1 and agx.

Instructions for Testing

• List all targets that this applies to: x1, agx, nx?
• List the test steps to verify:
  • Remove existing user, reboot and try to create ghaf as user
  • Create user, login with wrong password, observe only 1 error message
  • Login, create fingerprint for user, and lock screen.
    • Enter + fprint unlocks
    • wrong password + fprint unlocks
    • correct password unlocks
  • Reboot (gui-vm) and observe user is not asked for fingerprint
  • Verify ollama app works and no errors in journal anymore
  • (optional) test login/lock on agx as ghaf user

[milva-unikie]

Tested on Lenovo-X1 (nixos-rebuild switch)

Issues:

• Cameras do not work. Integrated camera should work in business-vm and usb camera in chrome-vm.

Working:

• Verified all steps in Testing instructions, no issues
• Test-automation passes

Tested on Orin-AGX and Orin-NX

• Login and lock work for both
• Test-automation passes for both

[mbssrc]

Tested on Lenovo-X1 (nixos-rebuild switch)

Issues:

* Cameras do not work. Integrated camera should work in business-vm and usb camera in chrome-vm.

Fixed with b3b1363.

[milva-unikie]

Cameras work!

Camera tests in test-automation will need a small change, pr for that is open tiiuae/ci-test-automation#205