feat(systemd): add some cgroup limits

Limit locksmith to some really small amount of CPU shares and a small amount
of memory.

/cc @marineam