tests: ignore masked units in check-and-shutdown

tests: ignore masked units in check-and-shutdown

Masking lvm2-monitor.service in 899dfbd45 did not actually stop it from
tripping the boot check: a masked unit that udev pulls in when scanning a
disk image's partitions still fails to start and is listed by
`systemctl --failed` with ACTIVE=failed. Masking only changed the LOAD
column from `not-found` to `masked`.

A masked unit failing to start is noise, not a real service failure in the
image, so filter masked units out of the failed-services check.

Also explain mkosi.postinst *why* lvm2-monitor.service even fails in the
first place: It's only installed in the initrd, not the main image. That
may or may not be a bug, but it's uninteresting for the "failed
services?" check.