Seccomp filter handling

[Jisu-Woniu]

In commit ecc839d, we introduced a seccomp filter config. However, how to use this file remains undecided.

There are two optional ways to handle this filter config:

1. Parse the file during compilation, thus hard-coding the processing logic for each system call.
2. Parse the file during runtime, allow end-users to change the logic without compilation.

Going with 2 seems promising, but it comes with performance penalty. It also makes it much more difficult for the dynamic handling of string syscall args, like pathname of openat.

What are your opinions?