Use OS APIs to Sandbox Zstd

Some Operating Systems provide tools that let processes give up their ability to perform various kinds of actions. If the process is hijacked somehow, this limits the ability of an attacker to cause damage to the system. It would be nice for the CLI to take advantage of this proactive privilege dropping, since (a) we don't need access to very many system features, and (b) although we are careful, we are doing classically dangerous things (handling untrusted input, doing partially unchecked array accesses and copies, interacting with uninitialized memory, etc.).

Examples we would integrate with would include:

- Linux: the [`seccomp()`](https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt) API, which lets you install a BPF program that gets called for each syscall you make, deciding whether to allow it to proceed or not.
- OpenBSD: the [`pledge()`](https://man.openbsd.org/pledge) API defines classes of operations you can reserve the right to use, disabling all the others.