use KillMode 'process' for systemd scope

use KillMode 'process' for systemd scope

KillMode 'none' is deprecated, and systemd loudly complains about that
in the journal. To avoid the warning, but keep the behaviour the same,
use KillMode 'process'.

This mode does two things differently, which we have to stop it from
doing:
* it sends SIGTERM right when the scope is cancelled (e.g. on shutdown)
 -> but only to the "root" process, which in our case is the worker
 instance forking QEMU, so it is already dead by the time this happens
* it sends SIGKILL to *all* children after a timeout
 -> can be avoided by setting either SendSIGKILL to false, or
 TimeoutStopUSec to infinity - for safety, we do both

In my testing, this replicated the previous behaviour exactly, but
without using the deprecated 'none' mode.

Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>