tacacs: T6613: dynamically build exclude_users list to avoid TACACS traffic

There is no need to send local base OS accounts like root or daemon to the
tacacs server. This will only make the CLI experience sluggish.

Build up a dynamic list of user accounts to exclude from TACACS lookup.