users: fix behavior of updating private keys

If account is locked, the private keys will be (present) and
owned by :root. User will not be able to access those keys.

If account is not locked, and the hiera string is empty, we
will ensure the private has correct permission: this is to
avoid overwritting keys that are created manually
users: check hiera data if valid to get private keys

The users key are in two forms
  1. Public key only (String)
  2. Both public and private keys are provided (Hash)
The private keys are only provided in the 2nd case.

Example in Hiera configuration

ssh.keys:
  pi: ssh-rsa <key>
  e:
    id_rsa: <private key in RSA format>
    default: <public key in any format>