seccomp: add support for seccomp through libseccomp

seccomp: add support for seccomp through libseccomp

The support is only for the monitor process (running as root). It is
enabled when the monitor has been initiliazed, before the event loop.

The monitor has to open a lot of files and read them (files in /proc,
/sys). Moreover, for some files, it has to write to them (for example,
stdout, /dev/log and for writing interface aliases). Therefore, there
are many registered syscalls. It should be possible to filter more but
this would require some efforts.

Becuase it is difficult to reliably report errors to the user and we
may have to execute arbitrary code because we need to resolve
hostnames (and therefore, connect to nscd, LDAP or anything else
handled by NSS), this does not seem to be reliable enough, yet.

Moreover, displaying failed syscall is a bit hackhish.

Maybe we could enable it by default if we change the default behaviour
from killing the offending process to just return a failed errno. Or
just logging the problem.