base-files: ship a static initial shadow db instead of creating it from passwd with...