Instead of installing authorized keys globally (same for everybody), we pass in the authorized_keys variable per user, and thus the installation also takes place per user. This makes much more sense and works with minimal refactoring.
Moved from system role where they used to be required into the (currently disabled) incus installation role.