document QubesDB+systemd provisioning pattern

[cfm]

Describe the change

Now that we have a pattern we like for configuring VM-specific services (freedomofpress/securedrop-workstation#1004), we should document it and/or provide a minimal example so that it's easily replicable.

How will this impact users?

As a Workstation developer, I don't want to reinvent the wheel.

As a new Workstation developer, I want an abstract example of what a wheel is, since that's a pattern I haven't seen in any other system I've worked on.