nfs-{server,client}: Mask rpc-svcgssd on clients, unmask on servers

The service gets pulled in by any nfs systemd unit, but is required (and
functional) only on servers.  As the service fails, monitoring complains.