fix: harden container privileges

openlist/compose.yaml

@@ -13,6 +13,10 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
     user: 1000:1000
     deploy:
       resources: