Landlock Sandboxing

ZStandard is exposed to a lot of attacker controlled input and sandboxing would help limit the damage exploits can do.

[Landlock](https://landlock.io/) ([LWN overview](https://lwn.net/Articles/859908/)) has been available in the kernel since 2021 and has been enabled by default in most distros for a while (Ubuntu 22.04 LTS, Fedora 35, Arch, etc.). It is stackable with other LSMs and unprivileged.

`seccomp()` has been [experimented with in the past](https://github.com/facebook/zstd/pull/1971), but dropped due to the brittle nature of syscall filtering.

Landlock is currently limited to restricting filesystem access but new features are planned (e.x. networking).