How to Protect a City: Strategic Security Placement in Graph-Based Domains