defaults: Add USBGuard configuration for Librem 5 and its devkit

This configures USBGuard to only accept allowlisted USB devices
appearing on the internal bus, and to accept everything on the
external bus.

Since g-s-d has USBGuard support that rejects devices attached
while the screen is locked, let's disable it by default for now
to not introduce potentially breaking UX changes. It can be
reenabled once it's properly configured and well-tested for our
use cases.
5 jobs for usbguard in 4 minutes and 27 seconds (queued for 4 seconds)