Customize seccomp profile

[jopemachine]

Main idea

As a follow-up to #3019, let's extend the functionality to enable selecting seccomp profiles other than default-profile.json.
For example, this feature could be useful if you want to block specific syscalls within a specific container, rather than allowing extra syscalls.

Of course, with the logic from #3019, modifying default-seccomp.json would allow blocking specific system calls.
However, in this case, the changes to the seccomp profile would affect all containers.

Alternative ideas

No response

Anything else?

No response