seccomp: Use an allow-list for socket domains

[vvoland]

Replace the open-ended range checks with the Linux address families the default profile supports. AF_ALG and AF_VSOCK remain blocked, and unknown or future domains now receive the profile's default EPERM response.

[thaJeztah]

Quick LLM review; in case it could indeed be an option;

Do we need to expand the existing < AF_ALG rule into 37 equality rules? The security-relevant change is replacing the open-ended > AF_VSOCK rule. We could retain < AF_ALG and == AF_NFC, then explicitly allow only AF_KCM through AF_MCTP. That gives seven rules instead of 43, still blocks all future families from the current AF_MAX onward, and preserves the existing handling of AF_UNSPEC.
Apart from making the JSON substantially smaller, fewer conditional rules should also keep the generated multi-architecture BPF filter smaller.

[vvoland]

Done.
FYI, I wanted to generalize this so it could produce multiple ranges, but we're limited to just one < rule because of: opencontainers/runc#2735

[thaJeztah]

LGTM

[thaJeztah]

@AkihiroSuda @djs55 PTAL