Linux sandbox: restrict pipe2() flags and forbid notification pipes

pipe2(fds, O_NOTIFICATION_PIPE) can be used to create "notification
pipes" on kernels built with CONFIG_WATCH_QUEUE.
Notification pipes are a rarely-used mechanism for sending notifications
about kernel events to userspace, and they are currently only wired
up to the kernel's keys subsystem.
Chrome renderers don't need this feature.

There have been several security bugs in notification pipes:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/?qt=grep&q=watch_queue

Most/all(?) of those bugs wouldn't have been reachable from a Chrome
renderer because of other restrictions anyway, but still, let's
prevent creation of notification pipes from renderers entirely.

Change-Id: I979ac987c60b2d9132d0e8545584fb8332d287b5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4128252
Commit-Queue: Robert Sesek <rsesek@chromium.org>
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Auto-Submit: Jann Horn <jannh@google.com>
Cr-Commit-Position: refs/heads/main@{#1088384}