function.sh: add cpu limit to security config