seccomp: add system call filtering using BPF