GRSecurity 3.0 compatibility

GRSecurity 3.0 restricts call_usermodehelper() to binaries in /sbin and certain system paths. The purpose of this change is to prevent a hypothetical vulnerability where a user with the ability to write into the kernel modifies modprobe_path from becoming a privilege escalation vulnerability. This breaks our usage of /bin/sh to call /bin/mount, so we introduce a new zexec_helper that we install to /sbin to replace our usage of /bin/sh.