It was kinda weird to assert that the clear-text password was
in the unit when the hashed password was the effective one.
This change makes it explicit that both are in there and the latter
takes precedence.
This commit adds two new tests to show that the ordering of password
overrides documentation in nixos/modules/config/user-groups.nix is
correct. The override behavior differs depending on whether a system
has systemd-sysusers enabled, so there are two tests.