Implement lockdown patches

[madaidan]

Implements parts of the new lockdown LSM that we need as the actual LSM is not available in LTS kernels.

This does not implement things we already solve with our hardened config (e.g. LOCKDOWN_KPROBES)