systemd: Allow running in containers

The systemd units were conditionalized on !container as well as
CAP_SYS_TIME.  There is nothing inherently wrong with running ntpd in a
container.  In typical containers, it will fail for lack of
CAP_SYS_TIME, but that is already handled by the second condition.  If
someone wants to run ntpd in a privileged container which has
CAP_SYS_TIME, it works fine.  I personally tested this.

This is the same approach used by chrony in Debian, which was also
discussed in this RedHat bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1306046

This was inspired by this bug report:
https://bugs.debian.org/890771