Make services.nscd non-forking

Systemd prefers non-forking services.

Another option is to use the -d flag. That also prevents forking and has
the side effect of making nscd log stuff to the journal. Unfortunately,
the nscd log is quite verbose (IMHO) and it seems to ignore the
debug-level option in nscd.conf, so I went with the --foreground flag.

(Side note, why does nscd need to be run with ExecStart =
"@${pkgs.glibc/sbin/nscd nscd ..." instead of a plain
"${pkgs.glibc}/sbin/nscd ..."? I couldn't get the latter to work; nscd
kept exiting with status 4. The manpage doesn't say what status 4 means.)