[Tor Gitlab #27315 - maint-0.3.5]: Fix seccomp sandbox rules for openat

[Jigsaw52]

The need for casting negative syscall arguments depends on the
glibc version. This affects the rules for the openat syscall which
uses the constant AT_FDCWD that is defined as a negative number.
This commit adds logic to only apply the cast when necessary, on
glibc versions from 2.27 onwards.

[coveralls]

Pull Request Test Coverage Report for Build 9606

• 0 of 10 (0.0%) changed or added relevant lines in 1 file are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage decreased (-0.003%) to 59.238%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
src/lib/sandbox/sandbox.c	0	10	0.0%

Totals
Change from base Build 9482:	-0.003%
Covered Lines:	43334
Relevant Lines:	73152

---

💛 - Coveralls