Fix seccomp filter set up in zygote

This needs to land with extra syscalls whitelisted, including capset and
setresuid.  These privileged syscalls are used in the setup after the
filter is initialized.

Test: system starts, different apps run
Bug: 63944145
Bug: 76461821
Change-Id: I49e6b292805f35baffb3530461c8741e75aceb32
Merged-In: I49e6b292805f35baffb3530461c8741e75aceb32