new detection: suspicious systemd units

[tstromberg]

Based largely on https://github.com/chainguard-dev/bincapz/tree/main/rules/systemd - this finds systemd units that were likely installed by malware.

references:

• https://attack.mitre.org/techniques/T1543/002/ (Create or Modify System Process: Systemd Service)
• https://www.cadosecurity.com/blog/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence
• https://sandflysecurity.com/blog/log4j-kinsing-linux-malware-in-the-wild/