resolved: run as unpriviliged "systemd-resolve" user

This service is not yet network facing, but let's prepare nonetheless.
Currently all caps are dropped, but some may need to be kept in the
future.