Restrict systemctl access for deploy user

[tdipiazza]

Deploy user currently doesn't have a password required for running systemctl commands and could do something bad. Make it more secure/better.

deploy ALL=(root) NOPASSWD: /usr/bin/systemctl, /usr/sbin/service