unotify: bound retained syscall statistics

[rndaom]

Summary

Bound seccomp-unotify report aggregation retained by the privileged supervisor.

The report path currently retains every distinct syscall record, including sandbox-influenced arguments and resource metadata. Add a bounded StatsStore with conservative entry and accounted-payload limits, checked arithmetic, saturating counters, an omission warning, and focused regression coverage. Existing retained records continue to aggregate after the unique-key limit is reached.

Why

This prevents unbounded supervisor-side telemetry retention when seccomp-unotify reporting receives many distinct sandbox-influenced records. The limits preserve normal reporting while making the retention policy explicit and bounded.

Validation

• focused unotify/stats_test
• normal nsjail rebuild
• focused test under ASan/UBSan and with NDEBUG
• git diff --check

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.