Fixes after review. Better pattern matching.
Remove access to hardware audio devices by default.
The recommended behaviour is to install the `audio` target, which
forwards the audio to CRAS (Chromium OS Audio Server).
Users who know what they are doing, and really need access to
hardware devices can add themselves to the group `hwaudio`.
Route audio from PulseAudio to CRAS.