Enable bind-tcp network restriction while enabling outgoing network acess

[tarasglek]

It would be nice if we could make --unrestricted-network only for outgoing network access when combined with listen restrictions

Linux Landlock supports combining LANDLOCK_ACCESS_NET_BIND_TCP and LANDLOCK_ACCESS_NET_CONNECT_TCP but landrun cli does not. A ruleset can handle restrict bind access and leave connect access unhandled.

  landrun --unrestricted-network --bind-tcp 12345 ...

acts like fully unrestricted network: outbound connects are allowed, but arbitrary TCP
binds are also allowed.

Landlock behavior with ll-bind-only.c testcase:

gcc -Wall ll-bind-only.c -o ll-bind-only && ./ll-bind-only

 Landlock policy: handle BIND_TCP only; allow bind :45678 only
 connect 1.1.1.1:443 by Landlock: ALLOWED
 bind :45678 by Landlock:          ALLOWED
 bind :45679 by Landlock:          DENIED

Desired behavior:

  landrun --unrestricted-network --bind-tcp 12345 ...

should mean:

• outgoing network unrestricted by default
• outbound connects remain allowed
• TCP bind/listen is allowed only on port 12345