proccontrol(1): implement 'nonewprivs'

[trasz]

Summary

This adds the 'nonewprivs' mode, corresponding to newly added
procctl(2) commands PROC_NO_NEW_PRIVS_CTL and PROC_NO_NEW_PRIVS_STATUS.

[trasz]

Note that this depends on https://reviews.freebsd.org/D30939.

[kib]

I wonder if it is better named 'nosetid', both in syscall and there.

[trasz]

In D30940#696482, @kib wrote:

I wonder if it is better named 'nosetid', both in syscall and there.

I've been thinking about it - "NO_NEW_PRIVS" is a rather silly name - but IMHO given that we're copying Linux semantics, we ought to also copy the name; it will make it less confusing and easier to grep for.

[trasz]

(Tinderboxed.)

[phk]

looks good to me

[trasz]

Thanks :-)