test: use seccomp on handshake test

[lrstewart]

Resolved issues:

resolves #4766

Description of changes:

I've got an s2n-tls handshake + app data running with seccomp, when built with aws-lc.

I integrated the tests into our existing cmake + ctest, so if we build seccomp into our codebuild images then we could run it as part of standard testing.

Call-outs:

I'm still debugging when built with openssl: X509_verify_cert appears to be trying to open a file to determine the local time? It works if I disable x509 validation. I included that test so that it's easy to repro, but left it disabled.

Testing:

New test. From the test output, you can see that it's running with seccomp linked:

...
-- feature S2N_STACKTRACE: TRUE
-- Linking tests with seccomp
-- Running tests with environment: S2N_DONT_MLOCK=1
...

The test also produced plenty of failures before I got the allowlist right :( Here's an example: https://github.com/lrstewart/s2n/actions/runs/10853333535/job/30121385790

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[lrstewart]

I debated putting this in a feature probe. I know it would be better, but it kind of seems like overkill :/ Thoughts?

[camshaft]

I guess it depends on a few things:

• Are there versions of these libraries that don't include this API and do we want to support those?
• Do we anticipate other libcryptos adding this API in the future?

[lrstewart]

I wouldn't expect other libraries to add it. It's not from openssl.

The API has been in aws-lc from the beginning: aws/aws-lc@3e4dfbb (note that commit was merged in the first PR, along with the rest of the boringssl history).

But it's only been in boringssl since 2020: google/boringssl@3e4dfbb However, we don't really have an alternative, so earlier versions would just not be sandboxable. Still, not being sandboxable is better than not building at all. Let me see if I can find a reasonable place for documentation.

[lrstewart]

Since we're not testing this on boringssl (and I doubt plan to), I restricted the call to aws-lc and documented the support.