[KeyManager] Add Seccomp hardening to the rust KCC

Since the KCC is a critical component, we should sandbox it against external attackers. We can enable seccomp filters (via [seccompiler](https://g3doc.corp.google.com/third_party/rust/seccompiler/v0_3/README.md?cl=head)) to whitelist `syscalls` strictly required for its operations and disable others, especially `fork, execve, socket`(creation) and `open` (filesystem) to protect against RCE attacks.
Allowed Syscalls: `read, write` (only to network FDs), `futex, getrandom, memfd_secret, mmap, munmap, close`.
```rust
rules.insert(libc::SYS_read, vec![]);
rules.insert(libc::SYS_write, vec![]);
rules.insert(libc::SYS_close, vec![]);
rules.insert(libc::SYS_futex, vec![]);
rules.insert(libc::SYS_getrandom, vec![]);
rules.insert(libc::SYS_mmap, vec![]);
rules.insert(libc::SYS_munmap, vec![]);
rules.insert(libc::SYS_memfd_secret, vec![]);

// Create the filter.
// - Default action (mismatch): Kill the process if a syscall is not in the whitelist.
// - Match action: Allow the syscall if it matches a rule.
let filter = SeccompFilter::new(
rules,
SeccompAction::KillProcess, // Action for blocked syscalls
SeccompAction::Allow, // Action for allowed syscalls
ARCH.try_into().unwrap());
let prog: BpfProgram = filter.try_into();
apply_filter(&prog);
```