Add sudo submodule, use it in users module

Ensure sudo permission is given to users defined in the manifest, so that we can drop root access.