fedora-cosmic: pass Kanidm token via systemd credential

kanidm-unixd runs with DynamicUser=yes, so it cannot read the root-only
/etc/kanidm/unixd_token. With service_account_token_path set in
/etc/kanidm/unixd the daemon failed with PermissionDenied and no Kanidm user
resolved. Drop that setting and inject the token with LoadCredential +
KANIDM_SERVICE_ACCOUNT_TOKEN_PATH through a generated drop-in.

Verified in a QEMU VM: kanidm-unixd active, 'kanidm-unix status' online,
'getent passwd job' resolves.

build.sh

@@ -137,10 +137,18 @@ seed_kanidm_token() {
   if [[ -n "${KANIDM_UNIXD_TOKEN:-}" ]]; then
     printf '%s\n' "${KANIDM_UNIXD_TOKEN}" > "${dir}/kanidm-unixd-token"
     chmod 0600 "${dir}/kanidm-unixd-token"
+    # kanidm-unixd is DynamicUser=yes, so it cannot read the root-only token
+    # file directly; hand it over as a systemd credential instead.
+    cat > "${dir}/kanidm-unixd-token.conf" <<'EOF'
+[Service]
+LoadCredential=unixd_token:/etc/kanidm/unixd_token
+Environment=KANIDM_SERVICE_ACCOUNT_TOKEN_PATH=%d/unixd_token
+EOF
     cat > "${out}" <<'EOF'
 # Generated by build.sh from the KANIDM_UNIXD_TOKEN secret.
 add-files:
   - ["kanidm-unixd-token", "/etc/kanidm/unixd_token"]
+  - ["kanidm-unixd-token.conf", "/usr/lib/systemd/system/kanidm-unixd.service.d/10-token.conf"]
 EOF
   else
     cat > "${out}" <<'EOF'