bootstrap-os: use the systemd module to stop and mask locksmithd

roles/bootstrap-os/tasks/bootstrap-coreos.yml

@@ -46,6 +46,9 @@
     PATH: "{{ ansible_env.PATH }}:{{ bin_dir }}"
 
 - name: Bootstrap | Disable auto-upgrade
-  shell: "systemctl stop locksmithd.service && systemctl mask --now locksmithd.service"
+  systemd:
+    name: locksmithd.service
+    masked: true
+    state: stopped
   when:
     - not coreos_auto_upgrade