feat(profiles): better system nss rules in nameservice-strict.

apparmor.d/profiles-m-r/pwck

@@ -24,7 +24,5 @@ profile pwck @{exec_path} {
   /etc/shadow.[0-9]* rw,
   /etc/shadow.lock wl,
 
-  @{run}/systemd/userdb/ r,
-
   include if exists <local/pwck>
 }

apparmor.d/profiles-m-r/rsyslogd

@@ -60,7 +60,6 @@ profile rsyslogd @{exec_path} {
   @{PROC}/cmdline r,
   @{PROC}/sys/kernel/osrelease r,
 
-  @{run}/systemd/userdb/io.systemd.Machine rw,
   @{run}/systemd/notify w,
 
   include if exists <local/rsyslogd>