roles/hardening: Change the lockdown file creation to run only at boot

Since after enabling lockdown you cannot change the file anymore until reboot,
change the tmpfile setting to use ! and run only at boot time. This makes
systemd-tmpfiles --create command to not fail, since it cannot write to the lockdown
file.

roles/hardening/files/50-lockdown.conf

-w /sys/kernel/security/lockdown - - - - integrity
+w! /sys/kernel/security/lockdown - - - - integrity