Set NoNewPrivileges on the krdpserver systemd service

From systemd documentation:

If true, ensures that the service process and all its children can
never gain new privileges through execve() (e.g. via setuid or setgid
bits, or filesystem capabilities). This is the simplest and most
effective way to ensure that a process and its children can never
elevate privileges again.

The idea of adding this to the server is to protect against exploit chains making use of LPE vulnerabilities like Copy Fail. In case there were an exploitable vulnerability in freerdp, krdpserver cannot be used to run an attack like Copy Fail which requires to execute su, which has set-user-ID.

Though there are still ways how a vulnerability in freerdp could result in an exploit. E.g. it is possible to write to $HOME and thus register an autostart script. Thus further measures might be required, but they might require tools like AppArmor or changing the systemd from user to system bus to be able to make use of sandboxing features.