user services: Rework the way ceres services are launched in a cleaner systemd-wide way. This also makes those recipes less asteroid-spcecific for systems with a different username.

abootimg, mkbootimg, mkboot, statefs, timed: Use the new pkg_postinst_ontarget syntax of OE sumo instead of the previously used failing pkg_postinst

Make sure user services are only run as ceres. Since openssh uses pam login, ssh root@watchIp would open a new systemd user session and start asteroid-launcher or other services as root

Setup permissions so that timed can change time: includes changing the connman's dbus allowing policy, adding a postinst script ran at boot to add CAP_SYS_TIME to timed-qt5 and add xattr to the DISTRO_FEATURES so that setcap is compiled