Harden nsncd.service

Where the authors are probably most familiar with what access is required, it would be nice if the `nsncd.service` file was updated with a good and secure default hardening setup.

When the service is running on NixOS there is _some_ hardening applied, but the service still gets a rating of `8.2 EXPOSED 🙁` in `systemd-analyze security nscd.service`. The existing hardening [is available here](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/system/nscd.nix#L138) ([here's another users config](https://github.com/rafaelsgirao/nixos-config/blob/main/modules/core/hardening.nix#L136)), and is obviously not very strict.

There is [an issue in the Nix repo](https://github.com/NixOS/nixpkgs/issues/377827) focused on hardening system services. While hopefully someone will pick up `nsncd` it would probably be better if the info was available here.

Start with the nsncd.service file and compare its current setup with the NixOS nscd.nix hardening configuration and the linked user configuration. Review the related Nix issue for context, then use systemd-analyze security nscd.service to evaluate the hardened defaults. Done means the service includes a well-justified secure default hardening setup.

Written by the indexing model from the issue text.