seccomp: move no-new-privs check into function

Commonize checks that the current task has either CAP_SYS_ADMIN
or no_new_privs into seccomp_has_no_new_privs().
seccomp: use valid mask for looping over modes
seccomp: Add extra options/actions

Pull a local copy of the draft patches from Will Drewry / Kees Cook
for sorting out synchronization of seccomp state, from:
https://lkml.org/lkml/2014/4/17/637
seccomp: adapt thread sync for mode bitmask
seccomp: remove MODE_LSM-specific thread sync

Now that the general seccomp thread sync code is available,
remove the LSM-specific code that attempts to synchronize
the seccomp mode of all threads.
seccomp: add options for LSM mode synchronization

Add new seccomp action SECCOMP_EXT_ACT_LSM which enables LSM
mode and also synchronizes the seccomp LSM mode across threads.

Also add action SECCOMP_EXT_ACT_LSM_TSYNC which synchronizes
the LSM mode state across threads.
capsicum: document branch structure