Improve pledge() usability and consistency

- We now kill the program on violations like OpenBSD
- We now print a message explaining which promise is needed
- This change also fixes a linkage bug with thread local storage
- Your sigaction() handlers should now be more thread safe

A new `__pledge_mode` global has been introduced to make pledge() more
customizable on Linux. For example:

    __attribute__((__constructor__)) static void init(void) {
      __pledge_mode = SECCOMP_RET_ERRNO | EPERM;
    }

Can be used to restore our old permissive pledge() behavior.

libc/runtime/fork-nt.c

@@ -55,10 +55,6 @@
 STATIC_YOINK("_check_sigchld");
 
 extern int64_t __wincrashearly;
-extern unsigned char __data_start[]; /* αpε */
-extern unsigned char __data_end[];   /* αpε */
-extern unsigned char __bss_start[];  /* αpε */
-extern unsigned char __bss_end[];    /* αpε */
 bool32 __onntconsoleevent_nt(uint32_t);
 
 static textwindows wontreturn void AbortFork(const char *func) {