service: relax PID file symlink chain checks a bit

[poettering]

Let's read the PID file after all if there's a potentially unsafe
symlink chain in place. But if we do, then refuse taking the PID if its
outside of the cgroup.

Fixes: #8085

[poettering]

This is very similar to @yuwata's #8098 but adds the suggested safety check for PIDs that are not part of the service's cgroup.

[keszybz]

From IRC:
15:40 < Xogium> zbyszek: it appears to work just fine on here with postgresql, recompiled 237 from
arch with the patch applied, installed that, made sure systemd was rloaded, removed
my modifications in postgresql.conf and did systemctl revert on the unit before
restarting, and it starts all fine now
15:41 < Xogium> I can test for dnsmasq in a few minutes as well if you'd like, I need to upgrade my
router anyways
15:44 < Xogium> zbyszek: yup also works for dnsmasq
15:45 < Xogium> so, it seems to be okay, nothing wrong that I can see
15:48 < Xogium> I don't got any daemon left to test with, so I hope this helps :D