seccomp: Add extended actions

Roll up Kees Cook's patch sequence into a single commit.
 - Add lock around task_struct.seccomp.filter
 - Set seccomp mode inside lock
 - Move no_new_privs into seccomp
 - Add SECCOMP_EXT_ACT options
seccomp: Make mode a bitmask

Make seccomp mode into a bitmask so that modes can be combined.
Only a single mode can be activated at a time, but when multiple
modes are active, the most restrictive result across all of the
modes is used.

Note that seccomp mode 1 generates SIGKILL whereas SECCOMP_RET_KILL
generates SIGSYS; ensure that behavior is preserved (and that
SIGKILL trumps SIGSYS if both are indicated).

Signed-off-by: David Drysdale <drysdale@google.com>
seccomp: add seccomp mode that invokes Capsicum

If CONFIG_SECCOMP_CAPSICUM is defined, support an additional seccomp
mode where each syscall is policed by the Capsicum security
framework via capsicum_intercept_syscall(), which returns a BPF
response code.

As with installing seccomp-bpf filters, enabling the seccomp
Capsicum mode requires that a task either has the CAP_SYS_ADMIN
capability, or that it has previously set no_new_privs.

The capability mode implemented by the Capsicum security framework
disables all system calls that access global namespaces, such as the
filesystem or IP:ports.

The set of allowed syscalls is intended to be as close as possible
to those allowed in the FreeBSD 10.x implementation of Capsicum, to
ease the porting of Capsicum-aware applications.

Add the ECAPMODE errno value to indicate that a particular syscall
has been rejected due to capability mode.

Signed-off-by: David Drysdale <drysdale@google.com>