Add toggle to skip enabling/starting the systemd timer

## Problem

The `google-extrausers-director` Ansible role always enables and starts the systemd timer at the end of the play. This makes it impossible to bake the role into a machine image (e.g. via Packer) with the service installed but disabled — the timer starts during the build and fails because no service account key is present yet.

## Use case

We want to include `google-extrausers-director` in our Cirrascale bare-metal QEMU images so that all dependencies (libnss-extrausers, nsswitch.conf, director scripts, systemd units) are pre-installed. The service account key and config would be injected later during a provisioning/deploy stage (cloud-init, Ansible at deploy time, etc.), at which point the timer would be enabled.

## Proposed solution

Add a variable (e.g. `extrausers_service_enabled: true`) that controls whether the role enables/starts the timer and runs the initial sync. When set to `false`:

- Skip the `Enable director timer` task
- Skip the `Run initial sync now` task
- Optionally skip the `Install service account key` task (since the key won't exist at image-bake time)

Default should remain `true` so existing behavior is unchanged.

## Affected tasks in `tasks/main.yml`

```yaml
- name: Enable director timer # line 238
- name: Run initial sync now # line 244
- name: Install service account key # line 219 (already gated on extrausers_sa_json)
```

Start in tasks/main.yml at the affected tasks around lines 219 and 238-244, and inspect how extrausers_sa_json currently gates service-account installation. Add the proposed variable with the existing behavior as its default, then verify that disabling it skips the timer enable/start and initial sync while preserving installation of the role's dependencies; confirm the default path remains unchanged.

Written by the indexing model from the issue text.