nfs-{server,client}: Mask rpc-svcgssd on clients, unmask on servers

The service gets pulled in by any nfs systemd unit, but is required (and functional) only on servers. As the service fails, monitoring complains.