fix(configuration): grant the platform sudo group only when sudo is set

roles/configuration/tasks/users.yml

@@ -26,17 +26,22 @@
 
 - name: Create user accounts
   vars:
-    configuration_user_group: "{{ _configuration_platform.user_group }}"
     # plaintext is hashed; a pre-computed crypt hash ($6$/$y$/...) passes through.
     configuration_user_pw: >-
       {{ item.value.password if (item.value.password | string)[:1] == '$'
          else item.value.password | password_hash('sha512') }}
+    configuration_user_groups: >-
+      {{ item.value.groups | default(
+           [_configuration_platform.user_group]
+           if (item.value.sudo | default(false)) not in [false, '', none]
+           else []) }}
     configuration_useradd_cmd: >-
       {{ chroot_command }} /usr/sbin/useradd --create-home --user-group
       --uid {{ 1000 + _idx }}
-      --groups {{ configuration_user_group }} {{ item.key }}
+      {{ ('--groups ' ~ (configuration_user_groups | join(','))) if (configuration_user_groups | length) > 0 else '' }}
       {{ ('--password ' ~ configuration_user_pw) if (item.value.password | default('') | string | length > 0) else '' }}
       --shell {{ item.value.shell | default('/bin/bash') }}
+      {{ item.key }}
   ansible.builtin.command: "{{ configuration_useradd_cmd }}"
   loop: "{{ system_cfg.users | dict2items }}"
   loop_control: