Clarify and centralised sysctls controlling kernel-debugger entry; add a
new case that allows entry when a signal is to be delivered to a sandbox
but is handled by the userspace runtime, which previously could not be
caught by the kernel debugger easily.