Feature: System Call Argument Filtering

[andrewkroh]

Suppose you want allow clone with specific arguments such as CLONE_NEWUSER. To accomplish this we need to add the ability to generate a BPF filter that can check the arguments.

BPF supports several operators: https://godoc.org/golang.org/x/net/bpf#JumpTest