add a test for SECCOMP_MODE_STRICT

Note that we don't add the test into the list of tests to run, because it will
fail without the associated kernel patch.

v2: spin lock until seccomp strict is set on the child

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>