core: Add ProtectHostname=private (#35447)

This PR allows an option for systemd exec units to enable UTS namespaces
but not restrict changing hostname via seccomp. Thus, units can change
hostname without affecting the host. This is useful for OS-like
containers running as units where they should have freedom to change
their container hostname if they want, but not the host's hostname.

Fixes: #30348

diff --cc man/systemd.exec.xml
Simple merge

diff --cc mkosi.conf
Simple merge