nixos/postgresql: set up sandboxing

Reduces the general exposure of the postgresql.service through systemd
hardening options.

nixos/tests/postgresql.nix

@@ -126,6 +126,8 @@ let
       with subtest("Initdb works"):
           machine.succeed("sudo -u postgres initdb -D /tmp/testpostgres2")
 
+      machine.log(machine.execute("systemd-analyze security postgresql.service | grep -v ✓")[1])
+
       machine.shutdown()
     '';