execute: split out mounting of credentials fs

execute: split out mounting of credentials fs

Let's add two new helpers: mount_credentials_fs() and
credentials_fs_mount_flags(). The former mounts a file system suitable
for storing of unencrypted credentials at runtime (i.e. a ramfs or
tmpfs). The latter determines the right mount flags to use for such a
mount.

Both functions mostly just take code from execute.c, but make two
changes:

1. If the kernel supports it we'll use a tmpfs with the new "noswap"
   mount option instead of ramfs. Was added in kernel 6.4, hence is very
   recent, but tmpfs is so much less crappy than ramfs, hence worth it.

2. We'll set MS_NOSYMFOLLOW on the mounts if supported. These file
   systems should only contain regulra files, hence no need to allow
   symlinks.