BORG backup: restrict client commands on remote SSH

Add on backup server to .ssh/authorized_keys:

command="borg serve --restrict-to-path /home/USER/REPO.borg",no-pty,no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-user-rc ssh-rsa KEY