feat(security): Implement seccomp.

[crabbymaniac]

No description provided.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 22.93%. Comparing base (589fbea) to head (28bdee4).

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #2015       +/-   ##
===========================================
- Coverage   83.50%   22.93%   -60.57%     
===========================================
  Files          70       37       -33     
  Lines       19315     6125    -13190     
===========================================
- Hits        16129     1405    -14724     
- Misses       3186     4720     +1534     

Flag	Coverage Δ
fuzz-cookie_parsing_sound	0.41% <ø> (ø)
fuzz-duration_from_float	0.28% <ø> (ø)
fuzz-encrypted_client_parsing	6.90% <ø> (-0.73%)	⬇️
fuzz-encrypted_server_parsing	10.12% <ø> (-1.33%)	⬇️
fuzz-ipfilter	2.59% <ø> (ø)
fuzz-key_exchange_request_parsing	5.14% <ø> (+1.18%)	⬆️
fuzz-key_exchange_response_parsing	3.79% <ø> (-0.05%)	⬇️
fuzz-packet_keyset	5.10% <ø> (-1.41%)	⬇️
fuzz-packet_parsing_sound	6.32% <ø> (-1.94%)	⬇️
fuzz-record_encode_decode	4.68% <ø> (ø)
test-aarch64-apple-darwin	?
test-x86_64-unknown-linux-gnu	?
test-x86_64-unknown-linux-musl	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[squell]

Neutral advice: it would help if the comment section of a PR is used. I can glean from the code changes what is being attempted here, but a motivation would be really helpful as well during an eventual review. E.g. how important is this, is this meant to protect against attacks or mistakes, and so on. It doesn't need to be particularly long.

There are also some long hanging fruit snagged in the CI (e.g. cargo fmt, make sure it builds)

[crabbymaniac]

This Is actually a a split of an existing PR, #2013 has the rationale behind it. I'll make sure to add comments in the future though.

[squell]

Thanks! A backreference to that PR would have sufficed :-)

[crabbymaniac]

I'm re implementing some stuff so that changes can be merged cleanly, I'll open another PR with clear comments. Sorry for opening these many PR's :/