seccomp: Add filter flag to opt-out of SSB mitigation

seccomp: Add filter flag to opt-out of SSB mitigation

If a seccomp user is not interested in Speculative Store Bypass mitigation
by default, it can set the new SECCOMP_FILTER_FLAG_SPEC_ALLOW flag when
adding filters.

OraBug: 28041771
CVE: CVE-2018-3639

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
(cherry picked from commit 00a02d0c502a06d15e07b857f8ff921e3e402675)
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Mihai Carabas <mihai.carabas@oracle.com>
 Conflicts:
	include/linux/seccomp.h
	include/uapi/linux/seccomp.h
	tools/testing/selftests/seccomp/seccomp_bpf.c
[No eBPF in UEK4]

Signed-off-by: Brian Maly <brian.maly@oracle.com>