defaults: oomprotect sshd and local_unbound

Add sshd and local_unbound to the oom protected services.
syslogd is protected by default already, document it.

This was discussed on arch@, see

https://lists.freebsd.org/archives/freebsd-arch/2023-November/000543.html

sshd is protected to be able to investigate and fix oom issues on systems
which don't have out-of-band console access.
local_unbound is protected as it may be enabled for local use and without
DNS a lot grinds to a halt (including sshd).

Relnotes: yes
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D42544