core: move notify sockets to /run and $XDG_RUNTIME_DIR

A service with PrivateNetwork= cannot access abstract namespace sockets
of the host anymore, hence let's better not use abstract namespace
sockets for this, since we want to make sure that PrivateNetwork=
is useful and doesn't break sd_notify().
core: enable PrivateNetwork= for a number of our long running services where this is useful
update TODO