Integrate runtime components into single runtime

[fw-immunant]

This is not yet applied to our compartmentalized binaries and tests, but runs a tiny (uncompartmentalized) demo program I've been linking against it manually for validation.

This PR will be ready for merging when the build-system work is done to integrate the runtime with our tests themselves, but we'll want a switch to build without the runtime (or disable it) so that we can debug tests, as the runtime (being a ptracer) conflicts with gdb and other debuggers.

This implements an initial coarse-grained syscall policy very similar to that described in #233, and integrates fine-grained syscall filtering as described in #235. As we validate this on our tests/demons/nginx we'll probably add syscalls to our allowlist to get closer to what #231 outlines.

[fw-immunant]

One wart here is that we use SECCOMP_FILTER_FLAG_NEW_LISTENER to get a seccomp_unotify fd, but we don't actually use this fd for anything. If we need to do more detailed inspection of syscall arguments in memory or if we need to inject fds into the inferior to simulate some syscalls, we likely will need this fd; see man 2 seccomp_unotify. But for now, we're setting up this infrastructure without it being load-bearing.

[rinon]

So as is the usage for this is to add the ia2-main library which wraps main to fork and run the binary? How does this interact with our existing wrapping of main to set the pkey?

Did you decide to do this rather than the external binary that runs a separate child with fork+exec? Or was this implementation before we discussed that?

[rinon]

Probably want to put this in the header?

[fw-immunant]

This is without the changes needed to support multiple threads and fork/exec; see #307.