Add --nonewprivs

Linux 3.5+ has prctl(PR_SET_NO_NEW_PRIVS) which prevents a process from
acquiring any extra privileges via execve(2).