seccheck: Initialize seccheck.Points only when needed.

This moves the initialization of `seccheck.Points` out of package-level
`init` and instead moves it to an explicit `seccheck.Initialize()` function.

On AMD64, this saves about 614KiB of heap memory that would otherwise always
be live.

PiperOrigin-RevId: 514813332

pkg/sentry/fsimpl/testutil/BUILD

@@ -30,6 +30,7 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/platform/kvm",
         "//pkg/sentry/platform/ptrace",
+        "//pkg/sentry/seccheck",
         "//pkg/sentry/time",
         "//pkg/sentry/vfs",
         "//pkg/sync",

pkg/sentry/fsimpl/testutil/kernel.go

@@ -34,6 +34,7 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/mm"
 	"gvisor.dev/gvisor/pkg/sentry/pgalloc"
 	"gvisor.dev/gvisor/pkg/sentry/platform"
+	"gvisor.dev/gvisor/pkg/sentry/seccheck"
 	"gvisor.dev/gvisor/pkg/sentry/time"
 	"gvisor.dev/gvisor/pkg/sentry/vfs"
 
@@ -49,6 +50,8 @@ var (
 
 // Boot initializes a new bare bones kernel for test.
 func Boot() (*kernel.Kernel, error) {
+	seccheck.Initialize()
+
 	platformCtr, err := platform.Lookup(*platformFlag)
 	if err != nil {
 		return nil, fmt.Errorf("platform not found: %v", err)