security_tracker: harden system service

Mount /usr, /etc read only, protect the /home, /tmp and kernel
directories. Also disallow privilige escalation.

roles/security_tracker/files/security-tracker-update.service

@@ -8,5 +8,14 @@ Group=security
 WorkingDirectory=/srv/http/security-tracker
 ExecStart=/usr/bin/make update
 
+NoNewPrivileges=yes
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+
 [Install]
 WantedBy=multi-user.target