Improve pledge() usability and consistency

- We now kill the program on violations like OpenBSD
- We now print a message explaining which promise is needed
- This change also fixes a linkage bug with thread local storage
- Your sigaction() handlers should now be more thread safe

A new `__pledge_mode` global has been introduced to make pledge() more
customizable on Linux. For example:

    __attribute__((__constructor__)) static void init(void) {
      __pledge_mode = SECCOMP_RET_ERRNO | EPERM;
    }

Can be used to restore our old permissive pledge() behavior.

libc/sysv/consts/kern.h

@@ -0,0 +1,21 @@
+#ifndef COSMOPOLITAN_LIBC_SYSV_CONSTS_KERN_H_
+#define COSMOPOLITAN_LIBC_SYSV_CONSTS_KERN_H_
+#if !(__ASSEMBLER__ + __LINKER__ + 0)
+COSMOPOLITAN_C_START_
+
+#define KERN_SOH       "\001"
+#define KERN_SOH_ASCII '\001'
+#define KERN_EMERG     KERN_SOH "0"
+#define KERN_ALERT     KERN_SOH "1"
+#define KERN_CRIT      KERN_SOH "2"
+#define KERN_ERR       KERN_SOH "3"
+#define KERN_WARNING   KERN_SOH "4"
+#define KERN_NOTICE    KERN_SOH "5"
+#define KERN_INFO      KERN_SOH "6"
+#define KERN_DEBUG     KERN_SOH "7"
+#define KERN_DEFAULT   ""
+#define KERN_CONT      KERN_SOH "c"
+
+COSMOPOLITAN_C_END_
+#endif /* !(__ASSEMBLER__ + __LINKER__ + 0) */
+#endif /* COSMOPOLITAN_LIBC_SYSV_CONSTS_KERN_H_ */