feat(profiles): better system nss rules in nameservice-strict.

apparmor.d/groups/freedesktop/polkit-agent-helper

@@ -35,7 +35,6 @@ profile polkit-agent-helper @{exec_path} {
   owner @{HOME}/.xsession-errors w,
 
   @{run}/faillock/[a-zA-z0-9]* rwk,
-  @{run}/systemd/userdb/io.systemd.DynamicUser w,
 
   include if exists <local/polkit-agent-helper>
 }

apparmor.d/groups/freedesktop/polkitd

@@ -52,7 +52,6 @@ profile polkitd @{exec_path} {
 
   @{run}/systemd/sessions/* r,
   @{run}/systemd/users/@{uid} r,
-  @{run}/systemd/userdb/io.systemd.DynamicUser w,
 
   # Silencer
   deny /.cache/ rw,