debian: do not add user to sudo group, lock root account
The qubes-core-agent-passwordless-root package ships sudo configuration,
adding to sudo group isn't needed.
Basically revert all changes made by qubes-core-agent-passwordless-root
installation.
Fixes QubesOS/qubes-issues#4015