execveat: simplify self-tests

Use explicit filenames and rely on the invoking Makefile setting
up dependencies.

Check that expected files exist.
seccomp: Add self-test of SECCOMP_RET_KILL

Check that a BPF with SECCOMP_RET_KILL generates SIGSYS.
seccomp: Make mode a bitmask

Make seccomp mode into a bitmask so that modes can be combined.
Only a single mode can be activated at a time, but when multiple
modes are active, the most restrictive result across all of the
modes is used.

Also modify the .intercept_syscall LSM hook to return a BPF
return code rather than a simple yes/no.

Note that seccomp mode 1 generates SIGKILL whereas SECCOMP_RET_KILL
generates SIGSYS; ensure that behavior is preserved (and that
SIGKILL trumps SIGSYS if both are indicated).
seccomp: Add self-test for dual seccomp mode