core: clearly refuse OnFailure= deps on units that can't fail

Similar, refuse triggering deps on units that cannot trigger.

And rework how we ignore After= dependencies on device units, to work
the same way.

See: #14142