pie: move seccomp before creds to avoid resoring them after setuid

Note that this doesn't actually fix the problem, because seccomp could
block the setuid call, and since we're now restoring when the task isn't
ptraced and in SECCOMP_SUSPEND mode, we can't guarantee that the seccomp
filters won't be suspended.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>