openssh: Run the one-time service before sshd.service