Add a basic seccomp2 syscall filter on Linux

It's controlled by the new Sandbox argument.  Right now, it's rather
coarse-grained, it's Linux-only, and it may break some features.
Merge remote-tracking branch 'public/gsoc-ctoader-cap-phase1-squashed'