Docs: note that service.masked may require service.disabled first (#61322)

[kimimgo]

Fixes #61322

Add a note to the service.masked docstring advising users to
disable the service before masking it, as masking an enabled
service can result in a systemd error.

[welcome]

Hi there! Welcome to the Salt Community! Thank you for making your first contribution. We have a lengthy process for issues and PRs. Someone from the Core Team will follow up as soon as possible. In the meantime, here's some information that may help as you continue your Salt journey.
Please be sure to review our Code of Conduct. Also, check out some of our community resources including:

• Salt's Contributor Guide
• Join our Community Discord
• Salt Project YouTube channel
• GitHub Discussions

There are lots of ways to get involved in our community. Every month, there are around a dozen opportunities to meet with other contributors and the Salt Core team and collaborate in real time. The best way to keep track is by subscribing to the Salt Community Events Calendar.
If you have additional questions, email us at saltproject.pdl@broadcom.com. We're glad you've joined our community and look forward to doing awesome things with you!

[frebib]

Sounds like a code bug that should be fixed. I'm not sure papering over it with documentation is a good "fix" here

[kimimgo]

@frebib Good point — you're right that systemctl mask itself handles enabled services without error (it overwrites the symlink). The fact that Salt fails here suggests it's checking for the existing symlink before calling systemctl mask, which is overly strict.

Looking at it again, the proper fix would be in the Salt service module code rather than documentation. I'll update this PR to investigate the actual code path, or close it if a code fix is more appropriate.

Thanks for the feedback!