units: refuse manual operations on factory-reset-now.target and friends

It is strictly mandatory that this is done during initial
transaction, and not later when the system is already running.
Hence let's refuse manual start for all of the involved units.
Additionally, refuse manual stop for systemd-factory-reset-complete.service,
as it flags the factory reset completion through
/run/systemd/factory-reset-complete, which never gets removed
for the whole boot.

units/factory-reset-now.target

@@ -11,3 +11,4 @@
 Description=Factory Reset Execution
 Documentation=man:systemd.special(7)
 Wants=systemd-factory-reset-complete.service
+RefuseManualStart=yes

units/systemd-factory-reset-complete.service.in

@@ -15,6 +15,8 @@ Requires=factory-reset-now.target
 After=factory-reset-now.target
 Conflicts=shutdown.target
 Before=shutdown.target
+RefuseManualStart=yes
+RefuseManualStop=yes
 
 [Service]
 Type=oneshot