go/runtime/host/sandbox/process: Seccomp policy generation fails on systems with prehistoric garbage

[Yawning]

"Amazon Linux" ships kernel 4.14.x, along with a horrifically prehistoric userland, from back when computers were vacuum tube based, and paper-tape was considered a reasonable storage medium. As a consequence the seccomp policy generation fails because libseccomp has no idea what clone3 is, as it was added in 5.3.

Failing to add the handers for clone3 should not be fatal, unless the system-call should exist on the system.

	clone3ID, err := seccomp.GetSyscallFromName("clone3")
	if err != nil {
		return err
	}
	err = filter.AddRule(clone3ID, seccomp.ActErrno.SetReturnCode(int16(syscall.ENOSYS)))
	if err != nil {
		return err
	}