lnd: add strict hardening

Add ProtectSystem=strict, remove PermissionStartOnly.

Extract the section of postStart that needs secrets dir write
access into a separate script with full privileges.

Simplify preStart and fix dataDir quoting.

modules/nix-bitcoin-services.nix

@@ -1,7 +1,7 @@
 # See `man systemd.exec` and `man systemd.resource-control` for an explanation
 # of the various systemd options available through this module.
 
-lib:
+lib: pkgs:
 
 with lib;
 {
@@ -42,4 +42,9 @@ with lib;
       to 127.0.0.1;";
     '';
   };
+
+  script = src: pkgs.writers.writeBash "script" ''
+    set -eo pipefail
+    ${src}
+  '';
 }