docs: excorcise NIS from nsswitch.conf

Let's replace the "compat" module in our proposed nsswitch.conf
configuration with "files", since it is not 1995 anymore.

Fedora and other distros have deprecated and removed NIS support a while
back. While others still retain some support I am not sure we should
advertise it in our examples. Downstream can of course still use
"compat" instead of "files" if they want to, but let's not confuse
people who don't care about NIS anymore with this.

Also, bring the nsswitch.conf snippet in README in line with what our
man pages say.

Also see: https://fedoraproject.org/wiki/Changes/retire_NIS_user_space_utils

README

@@ -383,15 +383,16 @@ GLIBC NSS:
         DynamicUser= setting in unit files.)
 
         To make use of these NSS modules, please add them to the "hosts:",
-        "passwd:" and "group:" lines in /etc/nsswitch.conf. The "resolve" module
-        should replace the glibc "dns" module in this file (and don't worry, it
-        chain-loads the "dns" module if it can't talk to resolved).
+        "passwd:", "group:", "shadow:" and "gshadow:" lines in
+        /etc/nsswitch.conf.
 
         The four modules should be used in the following order:
 
-                passwd: compat systemd
-                group: compat systemd
-                hosts: files mymachines resolve [!UNAVAIL=return] dns myhostname
+                passwd: files systemd
+                group: files [SUCCESS=merge] systemd
+                shadow: files systemd
+                gshadow: files systemd
+                hosts: mymachines resolve [!UNAVAIL=return] files myhostname dns
 
 SYSV INIT.D SCRIPTS:
         When calling "systemctl enable/disable/is-enabled" on a unit which is a