if users.mutableUsers is false, require root password to be set

Running `nixos-install` with `users.mutableUsers = false;` currently doesn't work. Following PR requires root password to be set once immutable users are used.

Also fixes #3788
It would be cleaner to check `users.mutableUsers` directly, i.e. something like
```
if [ "$(nix-instantiate --eval '<nixos>' -A config.users.mutableUsers)" = true ]; then ... fi
```
(Will need adjustment for the chroot.)