Some sandboxing for the systemd service
Some sandboxing for the systemd service

These have been derived via 'systemd-analyze security', let's see how
well they hold up over time.

aaronpuchert/throttle,aaronpuchert/throttle