co2_exporter: Actually apply systemd sandboxing

I don’t know how that FIXME could be in there for so long.

pkgs/co2_exporter/module.nix

@@ -38,7 +38,12 @@ in
 
         # systemd-analyze --no-pager security co2_exporter.service
         DynamicUser = true;
-        # FIXME
+        CapabilityBoundingSet = null;
+        PrivateUsers = true;
+        ProtectHome = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        SystemCallFilter = "@system-service";
       };
     };
   };