Hardening the generated Onionspray setup

Description

Apply some hardening in the generated config. Originally suggested in this comment.

Tasks

• Explicitly using the password-lock parameter when creating {{ onionspray_user }}.
• Hardening the systemd configuration (Onionprobe's template could be taken as example (this could be done later in a separate merge request, as would need some testing to make sure things won't break).