meson: Add optional landlock protection for monitor

meson: Add optional landlock protection for monitor

This introduces a new optional security feature to the LXC monitor process.

With this enabled, the monitor API used for communication between the
CLI (or other clients) and the container monitor will now run in a
dedicated thread and have a Landlock policy applied to that thread.

The thread trick is required as the monitor process is also responsible
for running post-stop tasks (hooks) which need full privileges as well
as also handling full container reboots which similarly require full
privileges.

The policy is pretty simple at this point. It allows access to /dev/pts,
/dev/ptmx and /sys/fs/cgroup as those are the few paths that the monior
actually needs to open (as opposed to just handing out existing
filedescriptors).

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>