Implement more security stuff

- Support deterministic stacks on OpenBSD
- Support OpenBSD system call origin verification
- Fix overrun by one in chibicc string token allocator
- Get all chibicc tests passing under Address Sanitizer

libc/calls/fallocate.c

@@ -38,7 +38,6 @@
  * @return 0 on success, or -1 w/ errno
  * @note limited availability on rhel5 and openbsd
  * @see ftruncate()
- * @syscall
  */
 int fallocate(int fd, int32_t mode, int64_t offset, int64_t length) {
   int rc;