Fix for TROVE-2017-001 and bug 21278.

(Note: Instead of handling signed ints "correctly", we keep the old
behavior, except for the part where we would crash with -ftrapv.)

Add a changes file.

Fixes bug 16248. Patch from cypherpunks.  Bugfix on 0.2.0.1-alpha.

"ours" merge to avoid reverting 17354, which was already fixed in
0.2.7.4-rc.

Reverting this in 0.2.6 only -- we're no backporting
seccomp2-loosening fixes to 0.2.6.

This reverts commit 2ec5e24c.

This is an "ours" merge to avoid conflicts on the authority list:
the 0.2.7 branch already has the tonga->bifroest merge.

This is a backport of 19728 and 19690