seccomp filter: Handle openat as well

Summary:
With glibc 2.26, the open syscall is not used anymore as openat is favored.
This causes the testcase to fail, which shows that openat is not handled
correctly by the seccomp filter.
This adds a testcase that tests both open and openat (needs to use direct
syscalls on glibc 2.26 as calls to open would otherwise result in openat)
and implements the proper handling for openat in the filter.

BUG: 384651

Test Plan:
Ran seccomp test before and after, now succeeds.
Ran make install, screenlocker still works.

Reviewers: Plasma, graesslin

Reviewed By: Plasma, graesslin

Subscribers: plasma-devel

Tags: Plasma

Differential Revision: https://phabricator.kde.org/D7806