Implement post-exec filter loading

Like firejail does, avoids the need to include a number of Go runtime calls (futex, rt_sigmask, nanosleep, epoll_wait) and execve into all filters.

Possible implementation:
1. Compile a separate "loader" DSO
2. Use memfd_create and write BPF code into FD.
3. Set LD_PRELOAD to inject "loader" DSO.
4. Exec target binary, passing filter FD to it (specify the FD number via env. var).
5. Have "loader" DSO load filter and unset FD number env. var on load.

This obviously will not work with statically linked executables, but most executables are dynamically linked with at least libc so it can be ignored.