Features:
* machinectl bash completion is missing
+* busctl bash and zsh completions are outdated
* Introduce PrivateDevices=yes/no which works like PrivateTmp= but for /dev setting up a tmpfs for it that only includes /dev/null, /dev/zero, /dev/random, /dev/urandom, but nothing else.