reported by devel at datenbrei dot de. The first location would overwrite the default value for a server, triggering the "`foo' rule specified more than once" error. This also needed a small tweak on how we match locations to avoid breaking other tests.

move the strip and fmt logic to their own function

add/remove syscalls from the BPF filter and move sandbox() after libevent initialisation

it's faster (statistically speaking) to first compute if the option is set and then fnmatch than the inverse. This way we can avoid unnecessary fnmatch.

it's a waste to loop through all fds. We know the *exact* number of clients that needs attention, so use that information to limit the looping.