nonetwork: disable network for processes with BPF seccomp