Fix empty command_args detection
Workaround Debian /sbin PATH issue

We need to run groupadd and it cannot be found in $PATH by default.
Fix `--cmd` and `--group` root check

I must be sleepy when writing those lines.
Explicitly set PR_SET_NO_NEW_PRIVS

libseccomp will set PR_SET_NO_NEW_PRIVS and it seems must be set
for libseccomp to work properly.

Set PR_SET_NO_NEW_PRIVS if libseccomp is not used.

Additionaly, allow root to disable this with `--no-new-privs false`.
This makes it possible to run special programs like sudo (dangerous),
ping, chromium, lrun (nested, crazy idea) etc.
Bump to 0.9.8