Improve php-fpm systemd unit file

- use PrivateTmp, now available everwhere, for better security
- add comment about how to customize the unit file

sapi/fpm/php-fpm.service.in

@@ -1,3 +1,7 @@
+# It's not recommended to modify this file in-place, because it
+# will be overwritten during upgrades.  If you want to customize,
+# the best way is to use the "systemctl edit" command.
+
 [Unit]
 Description=The PHP FastCGI Process Manager
 After=syslog.target network.target
@@ -7,6 +11,7 @@ Type=@php_fpm_systemd@
 PIDFile=@localstatedir@/run/php-fpm.pid
 ExecStart=@sbindir@/php-fpm --nodaemonize --fpm-config @sysconfdir@/php-fpm.conf
 ExecReload=/bin/kill -USR2 $MAINPID
+PrivateTmp=true
 
 [Install]
 WantedBy=multi-user.target