make SYS_fork non-fatal, musl uses it for fork(2)

--- a/security/sandbox/linux/SandboxFilter.cpp
+++ b/security/sandbox/linux/SandboxFilter.cpp
@@ -1253,6 +1253,8 @@
         // usually do something reasonable on error.
       case __NR_clone:
         return ClonePolicy(Error(EPERM));
+      case __NR_fork:
+        return Error(ENOSYS);
 
 #  ifdef __NR_fadvise64
       case __NR_fadvise64: