This disables update-engine and locksmithd with ignition instead of cloud-init so that they're really totally 100% disabled. Pretty much every way of disabling them with cloud-init is mildly racy. Fixes #31633
