seccomp: update "@default" seccomp group a bit

seccomp: update "@default" seccomp group a bit

Let's add more of the most basic operations to "@default" as absolute
baseline needed by glibc and such to operate. Specifically:

futex, get_robust_list, get_thread_area, membarrier, set_robust_list,
set_thread_area, set_tid_address are all required to properly implement
mutexes and other thread synchronization logic. Given that a ton of
datastructures are protected by mutexes (such as stdio and such), let's
just whitelist this by default, so that things can just work.

restart_syscall is used to implement EAGAIN SA_RESTART stuff in some
archs, and synthesized by the kernel without any explicit user logic,
hence let's make this work out of the box.