Restrict bootstrapd behavior in systemd service file

[benwaffle]

See this reddit comment and check out systemd.exec(5)

You just add some lines such as:

PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
ProtectSystem=full
ProtectHome=yes
NoNewPrivileges=yes