Use f-strings.

That's important for the '--generate' mode.

Don't check CONFIG_ARCH_MMAP_RND_BITS if CONFIG_ARCH_MMAP_RND_BITS_MAX
was not found.

That improves debugging.

SCHED_CORE is finally available for ARM64 and ARM.

SCHED_SMT was needed for that.

Refers to #83

Thanks to @vobst for the idea

Thanks to @izh1979 for the idea

Thanks to @izh1979 for the idea

Thanks to @izh1979 for the idea

Thanks to @izh1979 for the idea

Disabling kernel modules is a radical method to cut the kernel attack
surface. It may be useful for some systems.

Quoting CLIP OS recommendation:
```
Disable module loading once systemd has loaded the ones required for the
running machine according to a profile.
```