nixos/redmine: Apply more hardening options (#449140)

        CapabilityBoundingSet = "";

        LockPersonality = true;

        MemoryDenyWriteExecute = true;

        MountAPIVFS = true;

        NoNewPrivileges = true;

        PrivateDevices = true;

        PrivateMounts = true;

        PrivateTmp = true;

        PrivateUsers = true;

        ProcSubset = "pid";

        ProtectClock = true;

        ProtectControlGroups = "strict";

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "noaccess";

        ProtectProc = "invisible";

        ProtectSystem = "strict";

        ReadWritePaths = [

          cfg.stateDir