security: add conservative systemd hardening to aquamarine services

outputs/x86_64-linux/tests/security-service-hardening/expected.nix

@@ -0,0 +1,12 @@
+{
+  lib,
+  outputs,
+}:
+{
+  caddy = true;
+  postgresql = true;
+  gitea = true;
+  sftpgo = true;
+  v2ray = true;
+  transmission = true;
+}

outputs/x86_64-linux/tests/security-service-hardening/expr.nix

@@ -0,0 +1,18 @@
+{
+  lib,
+  outputs,
+}:
+let
+  cfg = outputs.nixosConfigurations.aquamarine.config;
+  # NoNewPrivileges on a service (all six exist on aquamarine). Note: the
+  # `? name` exists-check misbehaves on systemd.services here, so access directly.
+  svc = name: (cfg.systemd.services.${name}.serviceConfig or { }).NoNewPrivileges or false;
+in
+{
+  caddy = svc "caddy";
+  postgresql = svc "postgresql";
+  gitea = svc "gitea";
+  sftpgo = svc "sftpgo";
+  v2ray = svc "v2ray";
+  transmission = svc "transmission";
+}