systemd service provider should support masking

systemd knows three states for a service: enabled, disabled and masked. So far, the latter state doesn't seem to be supported by puppet's systemd service provider.

The difference of disabling and masking a service is as follows: a disabled service can be started as a dependency of another service or be started manually by a user. A masked service can neither.

Masking is done the same way as enabling or disabling:
systemctl enable|disable|mask <service>

So kindly implement either enable => mask(ed), ensure => masked (not sure what seems more logical) or mask(ed) => true|false in the systemd service provider.

Note: there's also a "unmask" command to systemctl. I figure ensure => enabled|disabled should always unmask the service additionally to enable|disable it.

Manpage:
http://0pointer.de/public/systemd-man/systemctl.html

QA

risk: medium
probability: medium
severity: low (can use exec, etc, to work around)
test level: unit (tested in spec/unit/provider/service/systemd_spec.rb)