Turn on some extra security features when running bundle in UID namespace.

Since we're now running with UID = 0 (albeit in a UID namespace), the system may sometimes decide to give us back capabilities that we don't want. Various prctls can be used to prevent this in different ways. Enable all of them.