seccomp: check in_compat_syscall, not is_compat_task, in strict mode