Hijack a writable or PATH-relative systemd unit

A root-run service with a writable unit file or a relative ExecStart lets an unprivileged user execute code as root on the next start.