Explicitly set PR_SET_NO_NEW_PRIVS

libseccomp will set PR_SET_NO_NEW_PRIVS and it seems must be set
for libseccomp to work properly.

Set PR_SET_NO_NEW_PRIVS if libseccomp is not used.

Additionaly, allow root to disable this with `--no-new-privs false`.
This makes it possible to run special programs like sudo (dangerous),
ping, chromium, lrun (nested, crazy idea) etc.
Bump to 0.9.8