Add a seccomp filter to prevent creating setuid/setgid binaries

This prevents builders from setting the S_ISUID or S_ISGID bits,
preventing users from using a nixbld* user to create a setuid/setgid
binary to interfere with subsequent builds under the same nixbld* uid.

This is based on aszlig's seccomp code
(47f587700d).

Reported by Linus Heckemann.

shell.nix

@@ -22,7 +22,8 @@ with import ./release-common.nix { inherit pkgs; };
       # For nix-perl
       perl
       perlPackages.DBDSQLite
-    ];
+    ]
+    ++ lib.optional stdenv.isLinux libseccomp;
 
   inherit configureFlags;