Use __builtin_annotation for limit_syscalls.

This annotation means, "from here on, limit me to these syscalls". It can't necessarily attach to something that accepts C attributes: for instance, we might put it just before a statement.