Unify privileged group configuration between pam, systemd, & polkit

[kira-bruneau]

I noticed that #339 added a sysusers.d config file that creates a gamemode group, but the with-pam-group option could be different, and the polkit policies aren't scoped by any group.

This PR adds with-privileged-group which unifies all privileged group configuration into one option, and scopes the polkit policies so that you must be a part of this group to run cpugovctl & gpuclockctl.

This PR also adds with-systemd-user-unit and with-systemd-group which default to true, but can be set to false to avoid installing systemd configs if they aren't necessary for the target platform.

The with-pam-group option has also been removed and renicing support is now enabled by default, but can be disabled by setting with-pam-renicing to false.