systemd: running service as ephemeral user requires special handling of sensitive files

Currently, Defguard service runs as an ephemeral user `defguard`. In that configuration, it is not possible to secure sensitive files, like RSA keys, because systemd picks up a random user ID.

Consider one of these fixes:

1. Create a dedicated user (e.g. `defguard`) during package installation.

2. Use `StateDirectory=` in service configuration. Reference: https://0pointer.net/blog/dynamic-users-with-systemd.html

Note: running the service as non-root prohibits binding to ports < 1024.