Improve pledge() usability and consistency

- We now kill the program on violations like OpenBSD
- We now print a message explaining which promise is needed
- This change also fixes a linkage bug with thread local storage
- Your sigaction() handlers should now be more thread safe

A new `__pledge_mode` global has been introduced to make pledge() more
customizable on Linux. For example:

    __attribute__((__constructor__)) static void init(void) {
      __pledge_mode = SECCOMP_RET_ERRNO | EPERM;
    }

Can be used to restore our old permissive pledge() behavior.

test/libc/calls/unveil_test.c

@@ -367,22 +367,13 @@ TEST(unveil, usedTwice_forbidden_worksWithPledge) {
     ASSERT_SYS(EACCES_OR_ENOENT, -1, open("garden/secret.txt", O_RDONLY));
     // verify the first filter is still working
     *gotsome = true;
-    ASSERT_SYS(EPERM, -1, socket(AF_UNIX, SOCK_STREAM, 0));
-    if (IsLinux()) {
-      ASSERT_SYS(0, 0, stat("garden/secret.txt", &st));
-      ASSERT_EQ(5, st.st_size);  // wut linux metadata is accessible
-    }
+    socket(AF_UNIX, SOCK_STREAM, 0);
     _Exit(0);
   }
   ASSERT_NE(-1, wait(&ws));
   ASSERT_TRUE(*gotsome);
-  if (IsOpenbsd()) {
-    ASSERT_TRUE(WIFSIGNALED(ws));
-    ASSERT_EQ(SIGABRT, WTERMSIG(ws));
-  } else {
-    ASSERT_TRUE(WIFEXITED(ws));
-    ASSERT_EQ(0, WEXITSTATUS(ws));
-  }
+  ASSERT_TRUE(WIFSIGNALED(ws));
+  ASSERT_EQ(IsOpenbsd() ? SIGABRT : SIGSYS, WTERMSIG(ws));
   EXPECT_SYS(0, 0, munmap(gotsome, FRAMESIZE));
 }