seccomp: skip supervisor for nested calls

The old code returned a fake epoll fd as the supervisor fd to avoid
refactoring the fd passing code, but it was just a hack.

This commit does things properly by allowing send_fd to accept -1 to
signify "send no file descriptor". A matching recv_fd will in turn
return -1.

This allows us to return -1 when the supervisor already exists somewhere
up the chain and skip the nested supervisor loop if that's the case.

Version 1.0.0-rc1