minecraft: add no-new-privileges and only enable rcon when web is active

roles/minecraft/templates/docker-compose.yml

@@ -29,9 +29,11 @@ services:
 {% endfor %}
     volumes:
       - "{{ minecraft_data_location }}:/data"
+    security_opt:
+      - no-new-privileges
     environment:
       EULA: "TRUE"
-      ENABLE_RCON: "true"
+      ENABLE_RCON: "{{ minecraft_enable_rcon_web | bool | lower }}"
       RCON_PASSWORD: "{{ minecraft_rcon_password }}"
       RCON_PORT: 28016
       # enable env variable replacement