systemd: SecureBits=noroot-locked and documentation