feat: add vault to pkcs11 group on hsm usage, add device allow list for systemd unit (fixes #426) (#434)