Improve pledge() usability and consistency

- We now kill the program on violations like OpenBSD
- We now print a message explaining which promise is needed
- This change also fixes a linkage bug with thread local storage
- Your sigaction() handlers should now be more thread safe

A new `__pledge_mode` global has been introduced to make pledge() more
customizable on Linux. For example:

    __attribute__((__constructor__)) static void init(void) {
      __pledge_mode = SECCOMP_RET_ERRNO | EPERM;
    }

Can be used to restore our old permissive pledge() behavior.

libc/calls/struct/statfs.h

@@ -0,0 +1,26 @@
+#ifndef COSMOPOLITAN_LIBC_CALLS_STRUCT_STATFS_H_
+#define COSMOPOLITAN_LIBC_CALLS_STRUCT_STATFS_H_
+#if !(__ASSEMBLER__ + __LINKER__ + 0)
+COSMOPOLITAN_C_START_
+
+struct statfs {
+  int64_t f_type;    /* type of filesystem */
+  int64_t f_bsize;   /* optimal transfer block size */
+  int64_t f_blocks;  /* total data blocks in filesystem */
+  int64_t f_bfree;   /* free blocks in filesystem */
+  int64_t f_bavail;  /* free blocks available to */
+  int64_t f_files;   /* total file nodes in filesystem */
+  int64_t f_ffree;   /* free file nodes in filesystem */
+  int64_t f_fsid;    /* filesystem id */
+  int64_t f_namelen; /* maximum length of filenames */
+  int64_t f_frsize;  /* fragment size */
+  int64_t f_flags;   /* mount flags of filesystem 2.6.36 */
+  int64_t f_spare[4];
+};
+
+int statfs(const char *, struct statfs *);
+int fstatfs(int, struct statfs *);
+
+COSMOPOLITAN_C_END_
+#endif /* !(__ASSEMBLER__ + __LINKER__ + 0) */
+#endif /* COSMOPOLITAN_LIBC_CALLS_STRUCT_STATFS_H_ */