Backport the addition of RestrictSUIDSGID= from systemd-242 and enable
RestrictSUIDSGID=yes for systemd services which use DynamicUser=yes
The defaults in v242 were changed to enable RestrictSUIDSGID=yes if
DynamicUser=yes is specified, but this backport doesn't do this and
RestrictSUIDSGID=yes has to be requested explicitly. Maintainers of
other services packages for Fedora should consider doing this.