Consider adding optional pre-configure seccomp filters

[SECURITY.md](https://github.com/containers/bubblewrap/blob/main/SECURITY.md) clarifies that it is not the task of bwrap to enure that a real security barrier is created.

However, as I understand it, there is a list of seccomp rules that are fundamental to ensuring that bwrap can function as a sandbox at all. For example: unshare, setns, or mount.

I originally wasn't in favor of adding this to bwrap, and thought we could put it into a library that uses bwrap. But now I think if we can find a good set or good multiple sets, we should add them.

The issue currently is that there are too many consumers that have to create seccomp rules for this themselves, and this is very prone to errors.

First step would be to have a table which lists what seccomp rules are needed and when. Sadly, even Flatpak etc don't properly document their seccomp rules.