Draft: Plumb secure-lock-screen support into systemd

Basically, this MR plumbs together all the secure-lock-screen functionality introduced in !251 with the logind signalling functionality I introduced into systemd in https://github.com/systemd/systemd/pull/31796

The systemd-specific bits are split out from !251 so that !251 can land before https://github.com/systemd/systemd/pull/31796 is landed into systemd upstream

Depends on !251 and https://github.com/systemd/systemd/pull/31796