archweb: harden mirror related further

Add some new systemd hardening features to network related services.

roles/archweb/templates/archweb-mirrorcheck.service.j2

@@ -20,6 +20,10 @@ PrivateDevices=true
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectControlGroups=true
+ProtectHostname=true
+RestrictRealtime=true
+CapabilityBoundingSet=
+MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=multi-user.target

roles/archweb/templates/archweb-mirrorresolv.service.j2

@@ -17,6 +17,10 @@ PrivateDevices=true
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectControlGroups=true
+ProtectHostname=true
+RestrictRealtime=true
+CapabilityBoundingSet=
+MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=multi-user.target