Mitigate BPF security issues

https://www.decadent.org.uk/ben/blog/bpf-security-issues-in-debian.html

Seems important (at least LPE and probably remotely exploitable given Ben blogged about it; public exploit is in the wild). It might impact #15018 (closed).

Related issues

Related to #15094 (closed)
Related to #15018 (closed)

Original created by @intrigeri on 15095 (Redmine)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information