SCHED_STACK_END_CHECK checks the magic value at the end
of the kernel thread stack, and VMAP_STACK adds guard pages near it.
So they do a bit different things, but VMAP_STACK is more reliable.

Thanks to @thestinger for the idea.

Refers to #98.

Use f-strings.

That's important for the '--generate' mode.

Don't check CONFIG_ARCH_MMAP_RND_BITS if CONFIG_ARCH_MMAP_RND_BITS_MAX
was not found.

That improves debugging.

SCHED_CORE is finally available for ARM64 and ARM.

SCHED_SMT was needed for that.

Refers to #83

Thanks to @vobst for the idea

Thanks to @izh1979 for the idea

Thanks to @izh1979 for the idea

Thanks to @izh1979 for the idea

Thanks to @izh1979 for the idea

Disabling kernel modules is a radical method to cut the kernel attack
surface. It may be useful for some systems.

Quoting CLIP OS recommendation:
```
Disable module loading once systemd has loaded the ones required for the
running machine according to a profile.
```