fs.direct option and network filtering

These commits add:
- an fs.direct option, which can be used to allow direct access to some paths without sandboxing
- network filtering options
- a few other smaller changes