add support for the hidepid proc feature

This adds a HideProcess boolean to system.conf to toggle the hidepid=2
feature for the main PID namespace. The ability to set hidepid=1 is not
exposed because there is little use case for it. Even though the kernel
exposes this as a mount option, it is a global setting across the
process namespace.

The /proc/$PID/ directories expose sensitive information like scheduler
timings usable for keylogging and defeating ASLR. It's also not uncommon
for applications or users to pass secrets like passwords via arguments.

The systemd-logind service needs an exception from the rule, so it
either needs membership in the proc group or it has to hang on to the
CAP_SYS_PTRACE capability. Since it has CAP_SYS_ADMIN anyway, the
capability method is used to keep the group optional for now.