use O_PATH when getting cgroup fd

O_PATH mode is enough to attach a bpf program to a cgroup, use it
instead of O_RDONLY

src/core/bpf-restrict-ifaces.c

@@ -128,7 +128,7 @@ static int restrict_ifaces_install_impl(Unit *u) {
         if (r < 0)
                 return r;
 
-        cgroup_fd = open(cgroup_path, O_RDONLY | O_CLOEXEC | O_DIRECTORY, 0);
+        cgroup_fd = open(cgroup_path, O_PATH | O_CLOEXEC | O_DIRECTORY, 0);
         if (cgroup_fd < 0)
                 return -errno;