mkosi: Only look for services in /usr and /etc

mkosi.images/system/mkosi.postinst.chroot

@@ -38,7 +38,7 @@ TTYVHangup=no
 CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
 EOF
     # ASAN and syscall filters aren't compatible with each other.
-    find / -name '*.service' -type f -exec sed -i 's/^\(MemoryDeny\|SystemCall\)/# \1/' {} +
+    find /usr /etc -name '*.service' -type f -exec sed -i 's/^\(MemoryDeny\|SystemCall\)/# \1/' {} +
 
     # `systemd-hwdb update` takes > 50s when built with sanitizers so let's not run it by default.
     systemctl mask systemd-hwdb-update.service