system: replace sudo with sudo-rs by default

sudo-rs IS smaller than sudo (-3.50 MiB according to dix)
and has features nobody (to my knowledge) uses

even though run0 is always there and is more useful,
in my experience completely removing sudo also seems to:
1. break `nh os` with a remote host
    "run0 does not support stdin password input for remote deployment"
2. break `nixos-rebuild --ask-elevate-password`
    "[Errno 2] No such file or directory: 'sudo'"
     (fixed with `--elevate run0`, of course)

defaults/system.nix

@@ -35,6 +35,11 @@ in
       # memtest86.enable = true;
     };
 
+    security = lib.mkDefault {
+      sudo-rs.enable = true;
+      sudo.enable = false;
+    };
+
     # use tmpfs for /tmp to minimize disk wear
     # consider disabling if you have very limited memory
     boot.tmp = lib.mkDefault {