[CRIU] rebased seccomp strict patchset + check thread's creds match

[Tycho Andersen]

Hi Pavel,

This set is a rebased seccomp set (there was a bit of conflict with the lsm
bits), but the first three patches should be the same (modulo rebase) as the
ones you looked at before. The kernel bits are now in seccomp/tip, so that bit
of the API should be "stable", since it's mostly agreed upon.

I did the checking threads work on top of this since it would conflict again.
I can send that as a separate series if you still want to hold off on merging
the seccomp stuff, just let me know.

Tycho