fix: disable userborn legacy state import

nixpkgs d2f6794 added `services.userborn.importLegacyState`, enabled by
default, which emits a `userborn-import-legacy.service` one-shot unit that
migrates state left behind by NixOS' update-users-groups.pl activation
script.

system-manager never ran that script, so there is nothing to migrate. Opt
out to keep the unit and the userborn-import-legacy package out of every
system closure.

Fixes the container-*-empty-config checks, which assert an exact allowlist
of the units an empty config may produce.

Author: jfroche

nix/modules/upstream/nixpkgs/userborn.nix

@@ -37,6 +37,12 @@ in
   services.userborn.enable = lib.mkDefault true;
   services.userborn.package = userborn;
 
+  # The legacy import is a one-shot migration of state left behind by NixOS'
+  # update-users-groups.pl activation script. system-manager never ran that
+  # script, so there is nothing to migrate; keep the unit and the
+  # userborn-import-legacy package out of the closure.
+  services.userborn.importLegacyState = lib.mkDefault false;
+
   # REMOVE when https://github.com/NixOS/nixpkgs/pull/483684 is merged
   systemd.services.userborn = lib.mkIf config.services.userborn.enable {
     # system-manager does not implement systemd aliases