This disables update-engine and locksmithd with ignition instead of
cloud-init so that they're really totally 100% disabled.

Pretty much every way of disabling them with cloud-init is mildly racy.

Fixes #31633