Investigate static analysis of fork/exec syscalls

[axw]

We are looking to extend APM Server so that it can run the java-attacher when running under Fleet: #7023. On Linux, APM Server uses seccomp to filter allowed syscalls. If we continue to rely on seccomp, we will need to allow additional syscalls in order to execute java-attacher: #7017

As an alternative, we could instead verify that APM Server's dynamic call graph does not include any invocations of os/exec.Command* or syscall.*Syscall* that might run something other than java-attacher. We would also need to vet non-pure Go packages, to ensure syscalls aren't snuck in that way.

[axw]

We decided that it was safe to disable seccomp. Eventually we would like to create a separate integration for agent attachment, and remove the need for fork/exec. At that time we can re-add seccomp filtering.