Full openrc network stack isolation

Here's the list of isolated services. (namespace isolation where applicable, seccomp-bpf, narrowed capabilities, Landlock, cgroup limits, and AppArmor):

1. dnsmasq ~ DNS/DHCP forwarding and caching
2. unbound ~ rec​ursive DNS resolver
3. dnscrypt-proxy ~ encrypted DNS proxy
4. tor ~ anonymity network / SOCKS proxy
5. dhcpcd ~ DHCP client (network configuration)
6. chrony ~ NTP time synchronization
7. acpid ~ ACPI event handling (power button, lid, etc.)
8. syslog-ng ~ system logging
9. iwd ~ wireless network daemon

Will probably isolate seatd and greetd tomorrow. Then this stack is complete and I can move on to the ISO build.