jail: don't let the jailed process outlive the jail

[JuliusBairaktaris]

ujail forwards SIGTERM to the jailed process and escalates to SIGKILL after the
term timeout, but there is no equivalent for ujail itself being SIGKILLed: the
jailed process keeps running with nothing left that can stop it, and whoever
supervises ujail sees it exit and starts a second instance of the daemon.

Both of procd's own supervisors send that SIGKILL:

• instance_timeout() escalates to SIGKILL when an instance does not stop on
  SIGTERM (service/instance.c).
• netifd SIGKILLs every child in netifd_kill_processes() when it exits
  (main.c), which is reached on a plain /etc/init.d/network restart whenever
  a jailed proto handler has not finished tearing down within the one second the
  init script sleeps after ifdown -a.

prctl(PR_SET_PDEATHSIG, SIGKILL) in the child closes it. It is set right
before the execve(), after the user/group and capability transitions
(set_jail_user(), the userns setreuid()/setregid() and
applyOCIcapabilities() all clear the setting on credential change, so an
earlier placement silently no-ops for -U/-G/-f jails). Since the parent
can die between fork() and the prctl, the child checks getppid() and
self-terminates when the parent is already gone — the death signal would
otherwise be bound to init's death and never be delivered.

The second commit changes how a signal death of the jailed process is reported:
ujail exits with 128 + WTERMSIG (the shell convention) instead of the bare
signal number. A supervisor that only reads WEXITSTATUS cannot tell a
signal-killed process from one that exited with the signal number as its code;
pppd's exit table collides head-on (EXIT_PEER_AUTH_FAILED is 9,
EXIT_CONNECT_TIME is 11), so a segfaulted pppd read as an auth failure and,
with option authfail 1, blocked the WAN link until manual intervention.

Testing

On an ipq807x router with a PPPoE uplink, pppd wrapped in
ujail -C … -c -- /usr/sbin/pppd … and started by netifd:

	kill -9 <ujail>
before	pppd survives; netifd starts a second pppd, two of them on one link
after	pppd is reaped with the jail; netifd restarts a single clean pair

hostapd, wpa_supplicant, ntpd and dnsmasq jails start and stop normally
with the patched ujail, including the -U/-G user jails whose setting the
placement change is what makes survive.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[JuliusBairaktaris]

@dangowrt @nbd168 — review ping.

When ujail itself is SIGKILLed the jailed process keeps running with nothing left that can stop it, and the supervisor sees ujail exit and starts a second instance of the daemon. Both of procd's own supervisors send that SIGKILL, and netifd's is reached on a plain /etc/init.d/network restart.

Relevant to every daemon jailed by openwrt/openwrt#24558, which is why it is listed there as merging first.