Only allow raw clone when the flags match pthread-style thread creation,
and return ENOSYS for clone3 so libc falls back to clone without giving
the sandbox an opaque process-creation syscall.
Drop the 32-bit audit architecture cases from the Linux sandbox while
here, since Ladybird does not support 32-bit systems and those paths
would need extra syscall variants.
Add --enable-sandbox to Ladybird and test-web, pass it through to
ImageDecoder, and make ImageDecoder install its Linux sandbox only when
the option is present.
The Linux implementation enables no_new_privs, configures glibc malloc
to avoid late CPU-count probes in helper threads, applies an empty
Landlock ruleset when available, and installs a seccomp filter for the
helper IPC, shared memory, threading, and decoding syscalls.
Deny plain read-only filesystem probes without granting file access, so
common runtime feature checks can observe the sandbox instead of
terminating the helper during normal decoding.
