fedora-cosmic: pass Kanidm token via systemd credential

kanidm-unixd runs with DynamicUser=yes, so it cannot read the root-only
/etc/kanidm/unixd_token. With service_account_token_path set in
/etc/kanidm/unixd the daemon failed with PermissionDenied and no Kanidm user
resolved. Drop that setting and inject the token with LoadCredential +
KANIDM_SERVICE_ACCOUNT_TOKEN_PATH through a generated drop-in.

Verified in a QEMU VM: kanidm-unixd active, 'kanidm-unix status' online,
'getent passwd job' resolves.

images/fedora-cosmic/files/kanidm-unixd

@@ -14,7 +14,8 @@ selinux = true
 # Members of this Kanidm POSIX group are allowed to log in via PAM.
 pam_allowed_login_groups = ["unix_users"]
 
-# Token for the Kanidm service account used to resolve identities. Provision it
-# at /etc/kanidm/unixd_token (a single line) after install, or remove this line
-# if the server permits anonymous reads.
-service_account_token_path = "/etc/kanidm/unixd_token"
+# NOTE: kanidm-unixd runs with DynamicUser=yes and cannot read a root-only file,
+# so the service account token (when seeded) is passed as a systemd credential
+# via the build.sh-generated drop-in
+# /usr/lib/systemd/system/kanidm-unixd.service.d/10-token.conf.
+# Do not set service_account_token_path here.