using agenix to provide password hashes to userborn does not work

A configuration like ```nix users.users.marienz.hashedPasswordFile = config.age.secrets.marienz-password-hash.path; services.userborn.enable = true; ``` does not work: nixpkgs [makes systemd-sysusers.service an alias for userborn.service](https://github.com/NixOS/nixpkgs/blob/640a98650258129a8d35f47ac5dd8a94e11a119e/nixos/modules/services/system/userborn.nix#L134-L136), and agenix [runs agenix-install-secrets.service after systemd-sysusers.service](https://github.com/ryantm/agenix/blob/9edb1787864c4f59ae5074ad498b6272b3ec308d/modules/age.nix#L285), but userborn tries to read the password hash from /run/agenix so it can create /etc/shadow. This results in boot logging: ``` Starting Manage Users and Groups... ... Failed to update user marienz: Failed to read hashedPasswordFile "/run/agenix/marienz-password-hash": No such file or directory (os error 2) ... Finished Manage Users and Groups. ... Starting agenix-install-secrets.service... ``` If I change the ordering from "after" to "before" by doing ```nix systemd.services.agenix-install-secrets.before = ["userborn.service"]; systemd.services.agenix-install-secrets.after = lib.mkForce []; ``` things seem to work (no errors logged)... but I see there's a chown to the "keys" group called by agenix-install-secrets that probably only works because the previous boot's /etc/groups is still there, and if I was using `age.secrets.<name>.owner` / `.group` that'd also be broken (so that's not the right fix). If I understand [how agenix integrates with system.activationScripts](https://github.com/ryantm/agenix/blob/9edb1787864c4f59ae5074ad498b6272b3ec308d/modules/age.nix#L311-L329) correctly, that had the chown broken out in a separate activation script to avoid this problem. Would it make sense to do something similar with two systemd services (moving the chown from agenix-install-secrets to a new agenix-chown.service, with the former before systemd-sysusers and the latter after)? I can probably cook up a PR if that approach sounds reasonable.