backend: require confirmation for signed channel updates [CI]

packaging/systemd/moshiro-backend-container.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=MoShiro Backend (signed container updates)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+EnvironmentFile=/etc/moshiro-update/backend.image
+Restart=always
+RestartSec=5
+TimeoutStopSec=30
+ExecStartPre=-/usr/bin/podman rm -f moshiro-backend
+ExecStart=/usr/bin/podman run --rm --name moshiro-backend --network host --read-only --tmpfs /tmp --security-opt no-new-privileges --cap-drop all --env-file /etc/moshiro/backend.env -v moshiro-backend-data:/data -v moshiro-backend-status:/data/update-status:ro ${IMAGE}
+ExecStop=/usr/bin/podman stop -t 20 moshiro-backend
+
+[Install]
+WantedBy=multi-user.target