Enhancement: add fileio and execve benchmark categories

[stevjoo]

The framework currently measures only 3 syscall categories: network (socket() + connect()), ptrace (PTRACE_ATTACH), and setuid (seteuid()). This misses the two most important operations that MACs control in practice: file access and program execution.

File access is the single most common MAC decision in real-world systems. Web servers reading config files, databases writing to log directories, containers accessing host volumes, these are all file operations governed by MAC policy. AppArmor is literally a path-based MAC, so its entire security model is built around file paths. Not measuring open() + read() means we're evaluating AppArmor without testing its primary operation. The relevant LSM hook is security_file_open().

Execve / domain transition is the most computationally expensive MAC operation. When execve() runs, the MAC has to determine the new process domain/label, evaluate whether the transition is permitted, and load the new security context. This is significantly heavier than a simple socket() or ptrace() check, and represents the worst-case overhead scenario. Not measuring this means we're missing the upper bound of MAC cost. The relevant LSM hooks are security_bprm_check() and security_bprm_creds_for_exec().

With only 3 categories, a reviewer can always argue "maybe the overhead is different for other syscalls." With 5 categories covering network access, process tracing, privilege escalation, file I/O, and program execution, we cover all major MAC-controlled operation classes and that argument falls apart.

Implementation-wise, bench_fileio.c would measure open() + read() + close() on a small temp file created during warmup. ALLOW expects fd >= 0, DENY expects errno == EACCES. bench_execve.c would fork() a child that calls execve("/bin/true", ...) and collects timing via pipe back to the parent. ALLOW expects exit code 0, DENY expects execve() to fail with EACCES. Both need corresponding entries in benchmark.h (new enum values), main.c (CLI options), runner.c (warmup cases), csv_writer.c and report.c (label arrays), Makefile (new source files), and updated AppArmor/SELinux policies to cover allow and deny rules for file read and exec.