Delegation is enabled for udev so that it can mess around with the
cgroup hierarchy to avoid killing control processes when it calls
cg_kill in on_post() when it goes idle. We don't actually care about
any specific cgroup controllers in udev, so set Delegate= to enable
delegation without delegating any controllers
Follow up for https://github.com/systemd/systemd/pull/22752
[Service]
CapabilityBoundingSet=~CAP_SYS_TIME CAP_WAKE_ALARM
-Delegate=pids
+Delegate=
DelegateSubgroup=udev
Type=notify-reload
# Note that udev will reset the value internally for its workers