Sandbox containerd's systemd service

**What I'd like:**
In the spirit of bottlerocket-os/bottlerocket#808, we should reduced the exposure rating of contaienrd's systemd service.

**Any alternatives you've considered:**
N / A

Review the containerd systemd service configuration and the referenced bottlerocket-os/bottlerocket#808 issue first. Determine the intended exposure reduction and the relevant service settings; done means the service is sandboxed to the agreed lower exposure rating and the project’s checks pass.

Written by the indexing model from the issue text.