Move docker group logic to bootsync, so it happens early enough in the boot process to be effective

My bad - bootlocal doesn't necessarily happen before we're logged in, but bootsync happens in tc-config, right after the user is created.