Explicitly set PR_SET_NO_NEW_PRIVS

libseccomp will set PR_SET_NO_NEW_PRIVS and it seems must be set
for libseccomp to work properly.

Set PR_SET_NO_NEW_PRIVS if libseccomp is not used.

Additionaly, allow root to disable this with `--no-new-privs false`.
This makes it possible to run special programs like sudo (dangerous),
ping, chromium, lrun (nested, crazy idea) etc.
chmod 0755 /dev if --remount-dev

Default mount options for tmpfs may be mode=0777, which is too
open. Explicitly set mode, uid and gid when mounting /dev.
Bump to 0.9.8