restrict-setuid: new sysctl for restricting all use of setuid() from non-root

This allows tasks which require root privilege to continue working, but disallows
the ability of gaining a uid=0 shell by using setuid() in a child process.