seccomp_restrict_sxid: return ENOSYS for openat2()

We reject all openat2() calls because it is currently not possible to
inspect its flags parameter via seccomp.

Fallback code is more likely to look for ENOSYS than EPERM.