determine whether invalid %fs (via clone or arch_prctl(ARCH_SET_FS)) undermines compartmentalization

[fw-immunant]

Split out of #233.

My concern is that if a hostile compartment A changes %fs before the victim compartment B looks for a TLS variable (by accessing the DTV via the TCB pointer at by %fs, then the latter compartment will look in the wrong place, effectively letting compartment A choose which values compartment B sees for its TLS variables. I think we need to forbid arch_prctl(ARCH_SET_FS) in our syscall filtering, which we could do in seccomp BPF.

This should be pretty self-contained, and a fix should include a PoC along with the fix.

[fw-immunant]

We may actually not be able to do this in seccomp BPF as BPF is stateless and we need to allow the first call in the program which is performed by glibc threading setup. Successive threads get their values of %fs from clone()... which may also be a problem if a hostile compartment performs clone() directly instead of going through pthread_create().