Implement generic constraints

- Revisited unconfined access:
  Can no longer ptrace domains
  Can no longer execmod and entrypoint and file objects
  Can no longer mmap_zero
  TODO: execmem, execstack, execheap
- Add secure_mode_insmod and secure_mode_policyload booleans
- Add domain_mmap_low boolean