augment seccomp lists in firejail.config

[smitsohu]

Contributes to #3219.

I didn't know where to put kcmp, so still no full solution.

[topimiettinen]

Nice idea! This allows the local admin or distro to make changes which may not make sense for others.

[topimiettinen]

Command line version would be nice and of course documentation is a must. Otherwise looks great.

[topimiettinen]

There is still a bug, where removing syscalls leads to empty seccomp lists (and these are not allowed). I'll add a minimal fix.

Perhaps the empty seccomp lists could be forbidden when user specifies them but allowed for internal use (or when the architecture specific version is empty etc).

[smitsohu]

Command line version would be nice

Command line version exists already: --seccomp=

and of course documentation is a must

Done.

Unlrelated to the changed code, I moved some parts of --seccomp documentation to --seccomp= because I had the impression it fits better there.

Perhaps the empty seccomp lists could be forbidden when user specifies them but allowed for internal use (or when the architecture specific version is empty etc).

Done (for default+drop list).