pkg/mgrconfig: change the snapshot attr semantics

[a-nogikh]

At the moment of its introduction, the attribute was overridable by enable_syscalls. However, since some of the malicious calls are actually variants of generic syscalls (e.g. ioctl), it has de-facto made it very easy to enable them also on non-snapshot instances.

Do not let enable_syscalls override this. Instead, only activate snapshot calls on the snapshot instances.

[dvyukov]

We need to at least produce an error, if a syscall is enabled by a full name, but we won't enable it.
If we I explicitly write full name, got no errors, but it's not enabled, looks like very bad failure mode.

But perhaps enabling by full name will be comparable amount of code to the check. If yes, then it looks even better.