seccomp: support "clone3" (return ENOSYS unless SYS_ADMIN is granted)
seccomp: support "clone3" (return ENOSYS unless SYS_ADMIN is granted)

clone3 is explicitly requested to give ENOSYS instead of the default EPERM, when CAP_SYS_ADMIN is unset.
See moby/moby PR 42681 (thanks to berrange).

Without this commit, rawhide image does not work:
```console
$ sudo ctr run --rm --net-host --seccomp registry.fedoraproject.org/fedora:rawhide foo /usr/bin/curl google.com
curl: (6) getaddrinfo() thread failed to start
```

Signed-off-by: Akihiro Suda <10ddef0dea2a66ab193b07198faa879adcb213d8@hco.ntt.co.jp>

thaJeztah/containerd,mikebrow/containerd,thaJeztah/containerd,dmcgowan/containerd,mikebrow/containerd,estesp/containerd,estesp/containerd,dmcgowan/containerd,containerd/containerd,containerd/containerd