Implement a virtual filesystem layer

This is a large bundle of commits that implements a virtual filesystem inside sandboxed processes.

One starts by mounting a filesystem by way of passing a mountpoint and Filesystem implementation to Sandbox::getVFS().mountFilesystem(). The VFS layer automatically handles mapping filesystem-specific file descriptor numbers to virtual descriptor numbers within the sandbox and back along with passing filesystem-relative paths to implementations with open/openat/access/etc.

Non-virtualized file descriptors (such as ones handled via IPC channels) are left untouched and syscall operations on those FDs are transparently handled by the kernel instead of the sandbox. A future revision of this API will allow Filesystems to simply rewrite syscalls to produce native file descriptors, eliminating a lot of the super slow userland ptrace() calls to read/write buffers.