MINOR: systemd: Add SystemD's SystemCallFilter option to the unit file

This option takes away system calls that are unneeded for haproxy's
operation and thus is a good defense in depth measure.

contrib/systemd/haproxy.service.in

@@ -27,6 +27,8 @@ Type=notify
 # ProtectKernelTunables=true
 # ProtectKernelModules=true
 # ProtectControlGroups=true
+# If your SystemD version supports them, you can add: @reboot, @swap, @sync
+# SystemCallFilter=~@cpu-emulation @keyring @module @obsolete @raw-io
 
 [Install]
 WantedBy=multi-user.target