Move the functionality of both modules into a new clanService.
root-password was previously just a special case of user-password. This
migrates it into a deduplicated clan service and adds checks
For secrets not part of the nix store there is no other way in NixOS to
restart a service after the secret is updated. One example is changing
password in userborn, which doesn't run as a activation script but as a
systemd service.
