Add hardening options to systemd unit

[erdnaxe]

These options increase the isolation of mautrix-* system services.

I have been using these options with mautrix-telegram without any issue (on NixOS 21.11).

I am not setting SystemCallFilter as it might cause issue with old systemd distributions such as Ubuntu 18.04.
I am not setting DeviceAllow, PrivateDevices, PrivateUsers, RestrictAddressFamilies and UMask as I have not enough knowledge about how other mautrix bridges could behave.

Thanks,

[kidhab]

ProtectSystem = strict mounts the whole file system as read only. This only works if you disable logging of your bridge - which is not the default. Hence a service with your proposed configuration refuses to start.

One solution is to add a BindPaths setting like BindPaths = /opt/mautrix-telegram/mautrix-telegram.log.