The `systemd-rfkill.*` service falls in the category of early things that need write access to `/var`, so we need to make sure we run before or it might hit the read-only sysroot. The long-term fix for this is https://github.com/ostreedev/ostree/issues/2115. Closes: https://github.com/coreos/fedora-coreos-tracker/issues/746