Use seccomp to disable setuid/setgid binaries in Linux sandbox

[zombiezen]

Nix uses seccomp to prevent setuid/setgid bits from entering the build, among a few other things. This issue tracks emulating this behavior.

[zombiezen]

Sat down to try to implement this and found that Go doesn't have direct support for seccomp. There is a library, but it needs to be executed in the child process. This means a helper binary and a cgo dependency.

Punting beyond MVP, but I'll remove any setuid/setgid bits in the store at the least.