executors: implement sys_fchmodat sandboxing for compilers

[quantum5]

No description provided.

[codecov-commenter]

Codecov Report

Merging #929 (d2cf897) into master (2ea839a) will increase coverage by 0.22%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master     #929      +/-   ##
==========================================
+ Coverage   86.61%   86.83%   +0.22%     
==========================================
  Files         138      138              
  Lines        4670     4726      +56     
==========================================
+ Hits         4045     4104      +59     
+ Misses        625      622       -3     

Impacted Files	Coverage Δ
dmoj/executors/compiled_executor.py	93.28% <ø> (+0.67%)	⬆️
dmoj/cptbox/tracer.py	83.27% <0.00%> (-1.82%)	⬇️
dmoj/result.py	89.33% <0.00%> (-1.34%)	⬇️
dmoj/utils/module.py	100.00% <0.00%> (ø)
dmoj/judge.py	72.64% <0.00%> (+2.20%)	⬆️
dmoj/utils/error.py	93.33% <0.00%> (+2.42%)	⬆️
dmoj/utils/helper_files.py	95.18% <0.00%> (+3.51%)	⬆️
dmoj/utils/os_ext.py	94.73% <0.00%> (+6.27%)	⬆️
dmoj/utils/load.py	73.91% <0.00%> (+7.24%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2ea839a...d2cf897. Read the comment docs.

[Xyene]

But leave the fixme comment, since it applies to the fchmod below.