Add some more seccomp filters, particularly to disable user namespaces because they are kind of scary.

Yes, Sandstorm itself totally relies on user namespaces, but we don't want sandboxed apps to do so.

Also re-enable ptrace in dev mode, because it's really useful. But keep in blocked when not running via spk dev.