The Varlink service enumerates image targets and needs a private mount namespace while dissecting images. Keep its sandbox in sync with systemd-sysupdated.service. Follow-up to 31616d00ef Fixes #43604
31616d00ef
Fixes https://github.com/systemd/systemd/issues/43498