seccomp filter should allow 'rseq' syscall for glibc 2.35

Originally reported downstream in Gentoo.

Need to allow this syscall like Chrony did.