[prefect] disable tpm2-abrmd

hosts/prefect/default.nix

···
     };
     services.scrutiny.collector.enable = false;
   };
+  security.tpm2.enable = false;
+  security.tpm2.abrmd.enable = false;
 }

nixosModules/default-config/security.nix

···
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
+let
+  inherit (lib) mkDefault;
+in
 {
   # Everything should use doas instead of sudo
   # Sudo is kept enabled for tools that ~can't~ won't use doas.
···
 
     # TPM configuration
     tpm2 = {
-      enable = true;
-      abrmd.enable = true;
-      applyUdevRules = true;
-      pkcs11.enable = false;
+      enable = mkDefault true;
+      abrmd.enable = mkDefault true;
+      applyUdevRules = mkDefault true;
+      pkcs11.enable = mkDefault false;
     };
 
     # Set up extra certificates for DN42 specifically