Add Landlock syscall tests

[connrg]

What this is

Tests for Linux Landlock — the kernel feature that lets a process lock itself into a limited set of files, network ports, and so on.

This follows the approach @EtiennePerot suggested in #13439: start by adding tests against the real Linux kernel, cover the rule types we'd want gVisor to support, and skip under gVisor (which doesn't implement Landlock yet). Once the suite is in, gVisor can be matched against it one feature at a time, dropping the "skip on gVisor" guard for each feature as it's implemented.

How the tests work

Landlock is one-way: once a process locks itself down it can't undo it, so a test can't apply a policy to itself without poisoning the whole test binary. As Etienne suggested, each test forks a child, locks the child down, has it try something, and the parent checks from the outside whether it was allowed or blocked (via the child's exit code). I used the existing seccomp.cc tests as a model, as he recommended.

What's covered

Grouped by the Landlock version that introduced each feature. Each test skips itself if the kernel is too old:

• files — reading, writing, listing directories, executing, creating, deleting, and truncating files (and creating/deleting directories)
• renaming/moving a file across directories
• binding and connecting TCP ports
• ioctls on device files
• "scopes" — blocking signals and abstract Unix sockets to processes outside the sandbox
• error cases for the three Landlock syscalls (bad fd, missing no_new_privs, unknown flags, and so on)

Plus two of the trickier guarantees: that the sandbox is inherited by child processes, and that stacking a second policy can only ever take access away, never add it.

The newest Landlock version (v7, audit) isn't covered yet — it needs a newer kernel than our test machines run. There's a TODO in the file.

Testing

Ran on Linux 6.14 (Landlock v6): 38 tests, all passing. On older kernels, the unsupported tests skip, and under gVisor everything skips.

Updates #13439.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[connrg]

I signed it!