Support returning ENOSYS in seccomp rules

`glibc` calls `clone3`, which has a very seccomp-unfriendly interface. Thankfully, it falls back to not using `clone3` if `clone3` is found to return `ENOSYS`. Therefore, for a `runsc` binary compiled with `cgo` (as with [this pull request](https://github.com/google/gvisor/pull/9551)), we can avoid allowing `clone3` through if we can get the seccomp rules to return `ENOSYS` for `clone3`.

Right now all we have is "allowed" vs "disallowed" syscalls. We need to support adding new `RuleSet`s for seccomp filters such that some syscall numbers can have the action of returning `ENOSYS` as error code.