Reland "Update Linux Seccomp syscall restrictions to EPERM posix_spawn/vfork"

This relands commit 65046b8f90d0336cbe5f2f15cc7da5cb798360ad,
plus an additional change:

Older versions of Bionic seems to use vfork() in their system()
implementations, so just EPERM it instead of crashing with SIGSYS.

Bug: 956644
Change-Id: Ibd84ca0a9c49cad3ba797a2632960f3978111c65
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1585108
Commit-Queue: Matthew Denton <mpdenton@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#657515}