Prove that Makefile is fully defined

The whole repository is now buildable with GNU Make Landlock sandboxing.
This proves that no Makefile targets exist which touch files other than
their declared prerequisites. In order to do this, we had to:

  1. Stop code morphing GCC output in package.com and instead run a
     newly introduced FIXUPOBJ.COM command after GCC invocations.

  2. Disable all the crumby Python unit tests that do things like create
     files in the current directory, or rename() files between folders.
     This ended up being a lot of tests, but most of them are still ok.

  3. Introduce an .UNSANDBOXED variable to GNU Make to disable Landlock.
     We currently only do this for things like `make tags`.

  4. This change deletes some GNU Make code that was preventing the
     execve() optimization from working. This means it should no longer
     be necessary in most cases for command invocations to be indirected
     through the cocmd interpreter.

  5. Missing dependencies had to be declared in certain places, in cases
     where they couldn't be automatically determined by MKDEPS.COM

  6. The libcxx header situation has finally been tamed. One of the
     things that makes this difficult is MKDEPS.COM only wants to
     consider the first 64kb of a file, in order to go fast. But libcxx
     likes to have #include lines buried after huge documentation.

  7. An .UNVEIL variable has been introduced to GNU Make just in case
     we ever wish to explicitly specify additional things that need to
     be whitelisted which aren't strictly prerequisites. This works in
     a manner similar to the recently introduced .EXTRA_PREREQS feature.

There's now a new build/bootstrap/make.com prebuilt binary available. It
should no longer be possible to write invalid Makefile code.

third_party/unzip/crypt.h

@@ -27,33 +27,7 @@
 #define __crypt_h
 #include "third_party/unzip/crc32.h"
 
-#ifdef CRYPT
-#  undef CRYPT
-#endif
-/*
-   Logic of selecting "full crypt" code:
-   a) default behaviour:
-      - dummy crypt code when compiling UnZipSFX stub, to minimize size
-      - full crypt code when used to compile Zip, UnZip and fUnZip
-   b) USE_CRYPT defined:
-      - always full crypt code
-   c) NO_CRYPT defined:
-      - never full crypt code
-   NO_CRYPT takes precedence over USE_CRYPT
- */
-#if defined(NO_CRYPT)
-#  define CRYPT  0  /* dummy version */
-#else
-#if defined(USE_CRYPT)
-#  define CRYPT  1  /* full version */
-#else
-#if !defined(SFX)
-#  define CRYPT  1  /* full version for zip and main unzip */
-#else
-#  define CRYPT  0  /* dummy version for unzip sfx */
-#endif
-#endif /* ?USE_CRYPT */
-#endif /* ?NO_CRYPT */
+#define CRYPT 1
 
 #if CRYPT
 /* full version */
@@ -146,9 +120,7 @@ void init_keys OF((__GPRO__ ZCONST char *passwd));
 #  endif
 #endif /* ZIP */
 
-#if (defined(UNZIP) && !defined(FUNZIP))
-   int  decrypt OF((__GPRO__ ZCONST char *passwrd));
-#endif
+int  decrypt OF((__GPRO__ ZCONST char *passwrd));
 
 #ifdef FUNZIP
    extern int encrypted;