Provide tested systemd hardening levels for the XWiki service

The units that run XWiki (tomcatN.service, xwiki.service) only use a few systemd sandboxing options. A script or a vulnerable extension running inside XWiki can therefore read most of the system, open any socket and run any program.

Let xinit write a hardening drop-in for the servlet unit at a chosen level, and test each level per installation type: its systemd-analyze security score, a functional suite (XWiki still works) and an attack suite (what code running inside XWiki can no longer do). The strictest level only allows running the JVM, which needs XWiki to be started with java directly rather than through the packages' shell scripts.