Cherry pick from Kicksecure security-misc

[cynicsketch]

We already borrow the module blacklist and bluetooth configuration from them. There is a lot more here that could be used right now; used by both Whonix and QubeOS and are generally useful and trustworth.

https://github.com/Kicksecure/security-misc

[cynicsketch]

Links of relevance:
More secure gitconfig can be enabled everywhere, even if git isn't installed it's just a couple kb of text that does, at worst, nothing bad nor good.
https://github.com/Kicksecure/security-misc/blob/master/etc/gitconfig

NetworkManager and systemd-networkd support for IPv6 privacy should be enabled alongside sysctl
https://github.com/Kicksecure/security-misc/blob/master/usr/lib/NetworkManager/conf.d/80_ipv6-privacy.conf
https://github.com/Kicksecure/security-misc/blob/master/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf

Legal disclaimer in banner. Doesn't add inherent security but it's just a few bytes of text and doesn't hurt to add; as long as it eventually scares at least one person from trying to hack someone it's worth it.
https://github.com/Kicksecure/security-misc/blob/master/usr/lib/issue.d/20_security-misc.issue

https://github.com/Kicksecure/security-misc/blob/master/usr/lib/systemd/coredump.conf.d/30_security-misc.conf (https://github.com/NixOS/nixpkgs/blob/e2dd4e18cc1c7314e24154331bae07df76eb582f/nixos/modules/system/boot/systemd/coredump.nix tldr; systemd.coredump.enable = false; doesn't actually reconfigure coredump to use Storage=none, so we need to do this manually.)

https://github.com/Kicksecure/security-misc/blob/master/usr/bin/remount-secure
Don't need to use this script, but we can harden the same mountpoints described here.

Other notes: We should probably make overrides for anything labeled "most_noexec_maybe." There's no good reason to have anything executable installed in /root, so an override for that would probably be unnecessary.

IPv6 privacy extensions can apparently cause breakage in some very specific environments, an override should be made for that as well.

As for the rest of security-misc, the rest of it seems to be relating to experimental scripts and unbreaking various stuff from said experimental scripts. We can entertain those later, but the links already listed here should be easy and effective to implement.

[cynicsketch]

Merged with exceptions for the filesystem hardening to ensure a functioning system.

TODO: Overrides for exec on certain mountpoints and removing IPv6 private addresses.