core: add new setting TemporaryFileSystem=

This introduces a new setting TemporaryFileSystem=. This is useful
to hide files not relevant to the processes invoked by unit, while
necessary files or directories can be still accessed by combining
with Bind{,ReadOnly}Paths=.

src/core/execute.h

@@ -219,6 +219,8 @@ struct ExecContext {
         unsigned long mount_flags;
         BindMount *bind_mounts;
         unsigned n_bind_mounts;
+        TemporaryFileSystem *temporary_filesystems;
+        unsigned n_temporary_filesystems;
 
         uint64_t capability_bounding_set;
         uint64_t capability_ambient_set;