vm-secure: Add missing tmpfiles.d and sysusers.d configuration in initrd

tmpfiles.d/systemd.conf is what copies /.extra/tpm2-pcr-signature.json to /run/systemd/tpm2-pcr-signature.json so that main boot can unlock home.