Apply systemd sandboxing by default to some services

[Patrick]

disable `ProcSubset=pid` due to onion-grater crash at startup

[Patrick]

Sdwdate failed to start in debian 12 bookworm (next release)

[Patrick]

abolish architecture specific syscall whitelist

[Patrick]

Would dropping SystemCallArchitectures=native simplify syscall filter?