add default security settings

[tzneal]

Issue number:

Closes #

Description of changes:
Adds a default security setting to block writable/executable memory for all services.

Testing done:

Before change:

# systemctl show containerd | grep -i MemoryDenyWriteExecute
MemoryDenyWriteExecute=no

After change:

bash-5.1# systemctl show containerd | grep -i MemoryDenyWriteExecute
MemoryDenyWriteExecute=yes

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[cbgbt]

I'm not very familiar with this systemd setting, but one thing I'm not so sure of is how it will interact with the migrations performed by the update system.

Migrations are written to sealed anonymous files, which I could see being included here.

I'm happy to test this and come back, but I'd be curious to test building an image with this change, then attempting to in- place update it.