Split OCI spec seccomp filter into (fixed, args-dependent) parts. - #17615

Prior to this change, any seccomp filter provided in the OCI spec would
get compiled to a long and full BPF program, which would be fully
optimized, and then later on the Sentry would evaluate it for every
syscall number (to build up its action cache), and come to the conclusion
that the vast majority of its syscall numbers are indeed cacheable.
This is a bit silly when the OCI spec itself already contains this
information. So now we split the OCI spec filter into two parts: the
non-args-dependent part, and the args-dependent part. The BPF program
only needs to contain the args-dependent part, while the non-args-dependent
part never gets encoded into the BPF program. This speeds up both
BPF program optimization (since the program is much shorter), and action
cache derivation (since most syscalls are already known to be
non-args-dependent and don't need to be evaluated, and because the BPF
program is much shorter too).

The goal of this change is to make `--oci-seccomp=true` cheap enough to
turn on by default, though this change doesn't flip the flag yet.

Benchmarks (with `--oci-seccomp=true` obviously):

```
BenchmarkStartupEmpty (//test/benchmarks/base:startup_test)
             │    before     │               after                │
             │    sec/op     │   sec/op     vs base               │
StartupEmpty     380.0m ± 1%   374.7m ± 2%  -1.40% (p=0.001 n=32)

$ docker run --rm --runtime=runsc alpine /bin/true
              │   before    │                after                │
              │   sec/op    │   sec/op     vs base                │
DockerRunTrue   618.4m ± 1%   614.5m ± 1%  -0.62% (p=0.045 n=300)

"OCI seccomp filters applied" step of the sentry startup timeline (from logs):
               │   before    │                after                 │
               │   sec/op    │    sec/op     vs base                │
OCISeccompStep   9.643m ± 6%   2.741m ± 21%  -71.57% (p=0.000 n=40)
```