Support returning ENOSYS in seccomp rules #12557
Description
glibc calls clone3, which has a very seccomp-unfriendly interface. Thankfully, it falls back to not using clone3 if clone3 is found to return ENOSYS. Therefore, for a runsc binary compiled with cgo (as with this pull request), we can avoid allowing clone3 through if we can get the seccomp rules to return ENOSYS for clone3.
Right now all we have is "allowed" vs "disallowed" syscalls. We need to support adding new RuleSets for seccomp filters such that some syscall numbers can have the action of returning ENOSYS as error code.