www/immich: Fix packaging and harden the service

The plist is now generated in full instead of relying on the temporary
one, which caught an undeclared link of sharp against glib and gettext.
Both are declared now.

The rc script gained an environment file, a child pid file so that stopping
the service leaves no orphans, a umask of 027 for the files it creates and
a configurable bind address. It also waits for postgresql and valkey.

pkg-message moved to files/pkg-message.in so that the paths it prints are
substituted, and the log files are rotated by newsyslog.

Sponsored by: Netzkommune GmbH