src/seccomp.c: make sure syscalls exist before banishing them

socket and sendto will not be defined in all cases.
Similarly, it may make sense to EINVAL socketcall(2) when it does
exist.

This change addresses both.

BUG=github.com/ioerror/tlsdate/issues/145
src/seccomp.c: Move allowed system calls up in the filter

There's no reason for an allowed system call to be in line
behind denied ones.  This change moves them to just after
the ABI enforcement section.
Merge pull request #152 from redpig/issue_145

Fixes for issue #145 and a small layout tweak