Include proto (tcp:// etc.) in formatted pkcs11_socket_path.
Don't try to unlink() non-UNIX socket paths.
gck_rpc_close_tls: The BIO is free'd by SSL_free() already.
main: Properly free tls data on exit.
Use libseccomp and shrink the allowed-list.

The list of allowed syscalls is shrinked by postponing seccomp
initialization to after the PKCS#11 module is initialized and
the network socket is opened.
Avoid stream based file operations.

Rewrite to use open() instead of fopen() to avoid having to
seccomp-allow the mmap() syscall.
Add seccomp filtering to dispatch threads.

Initialize seccomp again in dispatch threads, only requiring a
small subset of the syscalls required by the parent process.
Add seccomp allows to get through SoftHSM test suite.
Update packaging.