update TODO
util: when sealing memfds, also use F_SEAL_SEAL

Let's be strict here, since its better to be safe than sorry.