dont write password to systemd service file

Hello. Thanks for your work, code is nice and tidy. I'm using your repo, forked and adapted it to some of my own restic installations and dumps.

In the current state, the [`restic_password` is written into the systemd service file](https://github.com/angristan/ansible-restic/blob/535396963a6d5269375c95d271e7d0d8b9f21695/templates/restic-backup.service.j2#L15). One wouldn't think of this at first but this is worldreadable.

1. For one, you set [the permissions 644](https://github.com/angristan/ansible-restic/blob/535396963a6d5269375c95d271e7d0d8b9f21695/tasks/main.yml#L39)
2. even if users can't read the file (e.g. permission `400`), they might be able to read via `systemctl`. Try the following on an unprivileged user: `systemctl show restic-backup.service | grep PASSWORD`

Instead of writing secrets to a service file, one might use `LoadCredential` or even `LoadCredentialEncrypted` to load encrypted paswords from TPM via systemctl.
The easiest solution which works for all users of the repo would be to have an additional task, writing the password to `/root/.restic_password` with `u=r,go=` and load it via something like:

```
LoadCredential=restic_password_file:/root/.restic_password
Environment="RESTIC_PASSWORD_FILE=%d/restic_password_file"
```