We've previously moved the udevadm mangling out of
tails-unblock-network.service, but the NM startup handling was left in there.
So, NM could possibly start before the MAC address has been spoofed, which we
need to avoid.

Another option would have been to add all of this to PostLogin, but it has so
little to do with the Greeter's job that I felt it would be nicer to have
PostLogin simply run a script that does all the work, so that most of it is
self-contained in our main Git repo. For the same reason, this commit also
imports the restricted network detector startup in the very same script.