New directives NoExecPaths= ExecPaths=

Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC`
mount flag for the file system tree. This can be used to implement file system
W^X policies, and for example with allow-listing mode (NoExecPaths=/) a
compromised service would not be able to execute a shell, if that was not
explicitly allowed.

Example:
[Service]
NoExecPaths=/
ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib

Closes: #17942.

test/fuzz/fuzz-unit-file/directives.service

@@ -85,6 +85,7 @@ DirectoryMode=
 DirectoryNotEmpty=
 Documentation=
 DynamicUser=
+ExecPaths=
 ExecReload=
 ExecCondition=
 ExecStart=
@@ -147,6 +148,7 @@ MessageQueueMaxMessages=
 MessageQueueMessageSize=
 MountAPIVFS=
 NoDelay=
+NoExecPaths=
 NoNewPrivileges=
 NonBlocking=
 NotifyAccess=