Improve pledge() usability and consistency

- We now kill the program on violations like OpenBSD
- We now print a message explaining which promise is needed
- This change also fixes a linkage bug with thread local storage
- Your sigaction() handlers should now be more thread safe

A new `__pledge_mode` global has been introduced to make pledge() more
customizable on Linux. For example:

    __attribute__((__constructor__)) static void init(void) {
      __pledge_mode = SECCOMP_RET_ERRNO | EPERM;
    }

Can be used to restore our old permissive pledge() behavior.

third_party/lua/lunix.c

@@ -1381,6 +1381,7 @@ static int LuaUnixSiocgifconf(lua_State *L) {
 //     └─→ nil, unix.Errno
 static int LuaUnixPledge(lua_State *L) {
   int olderr = errno;
+  __pledge_mode = 0;
   return SysretBool(L, "pledge", olderr,
                     pledge(luaL_checkstring(L, 1), luaL_optstring(L, 2, 0)));
 }