Implement more security stuff

- Support deterministic stacks on OpenBSD
- Support OpenBSD system call origin verification
- Fix overrun by one in chibicc string token allocator
- Get all chibicc tests passing under Address Sanitizer

libc/calls/chmod.c

@@ -42,7 +42,6 @@
  * @errors ENOENT, ENOTDIR, ENOSYS
  * @asyncsignalsafe
  * @see fchmod()
- * @syscall
  */
 int chmod(const char *pathname, uint32_t mode) {
   if (!pathname) return efault();