tcpwrap: execute tcpwrap check in forked client, to avoid blocking name lookups in main systemd process

service: by default send service output to syslog, except for SysV services which should go to the console

socket: optionally call accept() for incoming connections and spawn one service instance per connection

We now make sure to run all services in their own session, possibly with
a controlling terminal.

This also extends the service and socket state machines a little.