seccomp: Compute cache individually for each task in the thread group.

The cache may not be reusable across tasks in case the tasks' "arch audit
number" (`t.image.st.AuditNumber`) is different.

In practice this should ~never be the case, but recompute the cache anyway
out of caution.

PiperOrigin-RevId: 586716339

pkg/sentry/kernel/seccomp.go

@@ -297,7 +297,9 @@ func (t *Task) AppendSyscallFilter(p bpf.Program, syncAll bool) error {
 		// Note: No new privs is always assumed to be set.
 		for ot := t.tg.tasks.Front(); ot != nil; ot = ot.Next() {
 			if ot != t {
-				ot.seccomp.Store(newSeccomp.copy())
+				seccompCopy := newSeccomp.copy()
+				seccompCopy.populateCache(ot)
+				ot.seccomp.Store(seccompCopy)
 			}
 		}
 	}