Include gmid.h as first header in every file, as it then includes config.h (that defines _GNU_SOURCE for instance). Fix also a warning about unsigned vs signed const char pointers in openssl.

add/remove syscalls from the BPF filter and move sandbox() after libevent initialisation

what if we receive a SIGHUP right after unblock_signal (or during the whole block_signals...unblock_signals) but *before* the wait_sighup? Yeah.

now it's symmetrical to listener_main().