systemd service hardening

[sleepy-nols]

should be fairly easy to implement, we already got a systemd-override with commented out hardeing.
https://wiki.archlinux.org/title/Jellyfin#Hardening