MT#49340 systemd hardening: restrict RestrictAddressFamilies

CVE-2026-31431 is relevant for services that permit the AF_ALG socket
type. Let's restic access to expected sockets only.

FTR, current state was:

  # systemd-analyze security ngcp-mediator | grep -v '✓' | grep RestrictAddressFamilies
  ✗ RestrictAddressFamilies=~AF_PACKET                          Service may allocate packet sockets                                                                   0.2
  ✗ RestrictAddressFamilies=~AF_NETLINK                         Service may allocate netlink sockets                                                                  0.1
  ✗ RestrictAddressFamilies=~AF_UNIX                            Service may allocate local sockets                                                                    0.1
  ✗ RestrictAddressFamilies=~…                                  Service may allocate exotic sockets                                                                   0.3
  ✗ RestrictAddressFamilies=~AF_(INET|INET6)                    Service may allocate Internet sockets                                                                 0.3

Change-Id: I61377e74cdbbc394e95281b153cdf82c65a7f6e9

debian/ngcp-mediator.service

@@ -58,6 +58,9 @@ PrivateUsers=true
 # NOTE: service runs as root, so option does not matter
 RemoveIPC=true
 
+# Restrict service to allocation of certain address families only
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
 # Restrict access to the various process namespace types the Linux kernel provides
 RestrictNamespaces=true