saves some bytes of memory and removes the limit on the maximum number of vhosts and location blocks.

it's needed by getdtablesize, at least on glibc

while there, add capsicum for the logger process

accept4(2) isn't part of any standard (even though it'll be part in the future) and raises warnings on some linux distro. Moreover, we don't have thread that may fork at any time, so doing a mark_nonblock after isn't a big deal.

fatal logs to the correct place, err only on stderr.

these are required to run on arch linux (at least)

fedora 33 issue an epoll_wait instead of pwait.

add/remove syscalls from the BPF filter and move sandbox() after libevent initialisation