Implement more security stuff

- Support deterministic stacks on OpenBSD
- Support OpenBSD system call origin verification
- Fix overrun by one in chibicc string token allocator
- Get all chibicc tests passing under Address Sanitizer

libc/calls/clock_gettime.c

@@ -50,7 +50,6 @@
  *     errno isn't restored to its original value, to detect prec. loss
  * @see strftime(), gettimeofday()
  * @asyncsignalsafe
- * @syscall
  */
 int clock_gettime(int clockid, struct timespec *out_ts) {
   /* TODO(jart): Just ignore O/S for MONOTONIC and measure RDTSC on start */