manager: Improve freeze/thaw for unrealized cgroup

manager: Improve freeze/thaw for unrealized cgroup

This is a follow-up for e50bfc89cefd4aafedaf2a7eacbf8b5ed80b134e

In that commit, we made Freeze/Thaw work with unrealized cgroups.
However, the unit was left in a strange state: it would be frozen by the
kernel but systemd would be unaware, and it remained possible to try and
realize the cgroup while the unit is supposed to be frozen. This commit
fixes the state tracking and prevents cgroups from being realized when
the unit is frozen.