nfs-{server,client}: Mask rpc-svcgssd on clients, unmask on servers

The service gets pulled in by any nfs systemd unit, but is required (and
functional) only on servers.  As the service fails, monitoring complains.

nfs-client/tasks/main.yml

@@ -76,10 +76,10 @@
   tags:
     - nfs-client
 
-- name: enable rpc-svcgssd iff we use kerberized NFS
+- name: Disable rpc-svcgssd
   systemd:
     name: rpc-svcgssd.service
-    masked: "{{ not nfs_enable_gss }}"
+    masked: true
   tags:
     - nfs-client
 

nfs-server/tasks/main.yml

@@ -59,6 +59,13 @@
   tags:
     - nfs-server
 
+- name: Unmask rpc-svcgssd.service
+  systemd:
+    name: rpc-svcgssd.service
+    masked: false
+  tags:
+    - nfs-server
+
 - name: ensure nfs-server is enabled and running
   service:
     name: nfs-server