systemd: Add example service hardening

Include some trivial sandboxing options in the provided service files
as an example and lead users to `systemd-analyze security`.

While being a trivial change and far from a secure service it is an
improvement and may push downstream packagers and/or users to add even
a bit of sandboxing.

Signed-off-by: srestegosaurio <lcdt@disroot.org>

systemd/system/radicle-node.service

@@ -25,6 +25,11 @@ Environment=RAD_HOME=/home/seed/.radicle RUST_BACKTRACE=1 RUST_LOG=info
 KillMode=process
 Restart=always
 RestartSec=3
+# Basic hardening options. For more please refer to `systemd-analyze security`.
+PrivateTmp=true
+ProtectSystem=strict
+NoNewPrivileges=true
+MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=multi-user.target

systemd/user/radicle-node.service

@@ -18,6 +18,10 @@ Environment=RUST_LOG=info
 KillMode=process
 Restart=always
 RestartSec=3
+# Basic hardening options. For more please refer to `systemd-analyze security`.
+PrivateTmp=true
+ProtectHome=true
+MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=default.target