systemd: unit hardening

[erdnaxe]

This increases the isolation of TheLounge service.

This patch does not set SystemCallFilter option as it might break old Debian-based distributions due to a different naming convention for predefined call sets.

AF_NETLINK must be allowed in RestrictAddressFamilies, else the service will crash on startup with the following error:

os.js:68
      throw new ERR_SYSTEM_ERROR(ctx);
      ^
SystemError [ERR_SYSTEM_ERROR]: A system error occurred: uv_interface_addresses returned Unknown system error 97 (Unknown system error 97)
    at Object.networkInterfaces (os.js:259:16)
    at getIfaceInfo (/xxxxx/thelounge/node_modules/cacheable-lookup/source/index.js:41:40)
    at new CacheableLookup (/xxxxx/thelounge/node_modules/cacheable-lookup/source/index.js:93:1
    at Object.<anonymous> (/xxxxx/thelounge/node_modules/got/dist/source/core/index.js:29:24)
    at Module._compile (internal/modules/cjs/loader.js:1085:14)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1114:10)
    at Module.load (internal/modules/cjs/loader.js:950:32)
    at Function.Module._load (internal/modules/cjs/loader.js:790:12)
    at Module.require (internal/modules/cjs/loader.js:974:19)
    at require (internal/modules/cjs/helpers.js:93:18) {
  code: 'ERR_SYSTEM_ERROR',
  info: {
    errno: 97,
    code: 'Unknown system error 97',
    message: 'Unknown system error 97',
    syscall: 'uv_interface_addresses'
  },
  errno: [Getter/Setter],
  syscall: [Getter/Setter]
}

[brunnre8]

Thanks for the work, however there's some things which should be discussed.