clean up enable_random_syscalls_biarch()

It's still pretty ugly, but a fair bit simpler than it was.
The actual number of syscalls enabled with -r will differ.
Think of -r as "enable at most this many" rather than "exactly this many"