Requested in FS#68548 and recently added to plocate upstream as well.

While we're at it, also add some basic hardening to updatedb.service,
and tweak its CPU priority and I/O scheduling class to ease strain on
the system.