fix(seccomp): extend default whitelist and merge ALLOWED_SYSCALLS

[Harsh23Kashyap]

Fixes #274

Related: langgenius/dify#38105

Problem

Code execution nodes intermittently fail with operation not permitted when modern glibc/CPython hits syscalls missing from the default seccomp whitelist (e.g. sched_getaffinity, statx, pipe2).

Setting ALLOWED_SYSCALLS also replaced the entire default whitelist instead of extending it, so the common workaround could break basic I/O syscalls.

Changes

1. Add missing modern syscalls to the default Python whitelist (amd64 + arm64).
2. Merge ALLOWED_SYSCALLS env extras onto the default list for Python and Node.js sandboxes.
3. Add unit tests for syscall list merge/parse helpers.

Verification

• go test ./internal/core/lib/... — pass (merge/parse tests)

[Harsh23Kashyap]

Verified locally: go test ./internal/core/lib/... — pass.

[Harsh23Kashyap]

Hey, this PR is ready for review when you have a chance. Happy to adjust if anything needs changing.