Fix some initial sandbox issues.

Allow files that weren't in the list; Allow the _sysctl syscall;
allow accept4 with CLOEXEC and NONBLOCK.
Only intern one copy of each magic string for the sandbox

If we intern two copies of a string, later calls to
sandbox_intern_string will give the wrong one sometimes.
Add 'rename' to the sandboxed syscalls

(If we don't restrict rename, there's not much point in restricting
open, since an attacker could always use rename to make us open
whatever they want.)
Remove nonsensical exec permission from sandbox code.
Drop 'fr' parameter from sandbox code.

Appearently, the majority of the filenames we pass to
sandbox_cfg_allow() functions are "freeable right after". So, consider
_all_ of them safe-to-steal, and add a tor_strdup() in the few cases
that aren't.

(Maybe buggy; revise when I can test.)
Add missing rename function for non-linux platforms
Clean up sandbox structures a bit

Drop pindex,pindex2 as unused.

Admit a type to avoid using a void*
Have sandbox string protection include multi-valued parmeters.
Upgrade warning about missing interned string for sandbox
Fix sandbox protection for rename

(We were only checking the first parameter of each rename call.)
Introduce arg-counting macros to wrap seccomp_rule_add()

The compiler doesn't warn about this code:
       rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 1,
           SCMP_CMP(0, SCMP_CMP_EQ, AT_FDCWD),
           SCMP_CMP(1, SCMP_CMP_EQ, param->value),
           SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|...));
but note that the arg_cnt argument above is only 1.  This means that
only the first filter (argument 0 == AT_FDCWD) is actually checked!

This patch also fixes the above error in the openat() filter.
Earlier I fixed corresponding errors in filters for rename() and
mprotect().
Make sure everything using an interned string is preceded by a log

(It's nice to know what we were about to rename before we died from
renaming it.)
Get Libevent's PRNG functioning under the linux sandbox

Libevent uses an arc4random implementation (I know, I know) to
generate DNS transaction IDs and capitalization.  But it liked to
initialize it either with opening /dev/urandom (which won't work
under the sandbox if it doesn't use the right pointer), or with
sysctl({CTL_KERN,KERN_RANDOM,RANDOM_UUIC}).  To make _that_ work, we
were permitting sysctl unconditionally.  That's not such a great
idea.

Instead, we try to initialize the libevent PRNG _before_ installing
the sandbox, and make sysctl always fail with EPERM under the
sandbox.
Add a couple of missing renames so the server sandbox works again
Use SCMP_CMP_MASKED_EQ to allow flags, not force them

Older versions of Libevent are happy to open SOCK_DGRAM sockets
non-cloexec and non-nonblocking, and then set those flags
afterwards. It's nice to be able to allow a flag to be on or off in
the sandbox without having to enumerate all its values.

Also, permit PF_INET6 sockets. (D'oh!)
Allow reloading torrc and writing to router-stability
Don't allow change to ConnLimit while sandbox is active
Don't reload logs or rewrite pidfile while sandbox is active
Sandbox: permit O_NONBLOCK and O_NOCTTY for files we refuse

OpenSSL needs this, or RAND_poll() will kill the process.

Also, refuse with EACCESS, not errno==-1 (!).
Block certain option transitions while sandbox enabled