[LFI][X86] Add control-flow rewrites (#210913)
This adds LFI rewrites for control-flow operations. All jumps and
calls are rewritten so that their target is both guaranteed to be within
the sandbox, and at an address that is a multiple of the bundle size.
When combined with bundling, this restricts control-flow to the sandbox
region.
With Intel MPK support, this can provide a complete sandbox. A future
patch will also introduce software-based memory sandboxing so that MPK
is not required for memory isolation.
