Kernel: Add a way to specify which memory regions can make syscalls

This patch adds sys$msyscall() which is loosely based on an OpenBSD
mechanism for preventing syscalls from non-blessed memory regions.

It works similarly to pledge and unveil, you can call it as many
times as you like, and when you're finished, you call it with a null
pointer and it will stop accepting new regions from then on.

If a syscall later happens and doesn't originate from one of the
previously blessed regions, the kernel will simply crash the process.

Kernel/API/Syscall.h

@@ -190,7 +190,8 @@ namespace Kernel {
     S(mremap)                 \
     S(set_coredump_metadata)  \
     S(abort)                  \
-    S(anon_create)
+    S(anon_create)            \
+    S(msyscall)
 
 namespace Syscall {