In case of btcpayserver the default onion service is a security risk because any visitor can register an admin account on a freshly setup node.
Also remove the unneeded definition of ReadWritePaths because the service doesn't need write access to onion files.
Move 'enforceTor' and onion-service definitions from secure-node.nix. Use the onionServices module to define onion services. Onion services now automatically work for services that bind to an INADDR_ANY (`0.0.0.0`) address.
