systemd likes to touch /run/nologin to prevent SSH connections
while not fully initialized, a behavior frowned upon as there
isn't any warranty the file will be removed on system failure.

Furthermore, restrict non root login isn't a solution on servers
where root access isn't possible through SSH.

Fixes T1194.

Running the state on Eglide, output was well the expected diff:

-account    required     pam_nologin.so                                                                                        
+#account    required     pam_nologin.so