This fixes using coderepos in /home, by allowing the coderepo paths to be bind mounted into an otherwise empty /home tmpfs. Since this was the usecase for making ProtectHome= overrideable, we don't need the mkDefault any more.