This configures USBGuard to only accept allowlisted USB devices
appearing on the internal bus, and to accept everything on the
external bus.

Since g-s-d has USBGuard support that rejects devices attached
while the screen is locked, let's disable it by default for now
to not introduce potentially breaking UX changes. It can be
reenabled once it's properly configured and well-tested for our
use cases.