Add toggle to skip enabling/starting the systemd timer

[fluidnumericsJoe]

Problem

The google-extrausers-director Ansible role always enables and starts the systemd timer at the end of the play. This makes it impossible to bake the role into a machine image (e.g. via Packer) with the service installed but disabled — the timer starts during the build and fails because no service account key is present yet.

Use case

We want to include google-extrausers-director in our Cirrascale bare-metal QEMU images so that all dependencies (libnss-extrausers, nsswitch.conf, director scripts, systemd units) are pre-installed. The service account key and config would be injected later during a provisioning/deploy stage (cloud-init, Ansible at deploy time, etc.), at which point the timer would be enabled.

Proposed solution

Add a variable (e.g. extrausers_service_enabled: true) that controls whether the role enables/starts the timer and runs the initial sync. When set to false:

• Skip the Enable director timer task
• Skip the Run initial sync now task
• Optionally skip the Install service account key task (since the key won't exist at image-bake time)

Default should remain true so existing behavior is unchanged.

Affected tasks in tasks/main.yml

- name: Enable director timer        # line 238
- name: Run initial sync now          # line 244
- name: Install service account key   # line 219 (already gated on extrausers_sa_json)