fix(update-fedora-template-if-new): run as GUI user

---for parity with the case where the user has run the Qubes Updater
directly.  Without "runas", the new template's update log in
"/var/log/qubes/update-${TEMPLATE}.log" will by owned by root:qubes,
breaking subsequent updates that expect to be able to write to it as
user:qubes.

securedrop_salt/sd-sys-vms.sls

@@ -14,6 +14,8 @@ include:
 {% set sd_supported_fedora_version = 'fedora-41' %}
 {% set sd_fedora_base_template = sd_supported_fedora_version + '-xfce' %}
 
+{% set gui_user = salt['cmd.shell']('groupmems -l -g qubes') %}
+
 # Install latest templates required for SDW VMs.
 dom0-install-fedora-template:
   cmd.run:
@@ -33,6 +35,7 @@ set-fedora-template-as-default-mgmt-dvm:
 update-fedora-template-if-new:
   cmd.wait:
     - name: qubes-vm-update --quiet --force-update --targets {{ sd_fedora_base_template }}
+    - runas: {{ gui_user }}
     - require:
       - cmd: dom0-install-fedora-template
       # Update the mgmt-dvm setting first, to avoid problems during first update