doc: clarify seccomp_rule_add syscall translation behavior

libseccomp performs a translation step when adding a raw syscall value
to a multi-architecture filter. For instance, when adding __NR_open
(syscall value 2 on x86-64) to a filter containing x86 and x86-64 where
the native ABI is x86-64, the x86 BPF branch will use the value 5
(__NR_open on x86).

This commit adds explicit documentation for the translation step.

Refs seccomp#259.

Signed-off-by: Tudor Brindus <[email protected]>

doc/man/man3/seccomp_rule_add.3

@@ -147,7 +147,10 @@ value directly using the standard
 values, in order to ensure proper operation across multiple architectures it
 is highly recommended to use the
 .BR SCMP_SYS ()
-macro instead.  See the EXAMPLES section below.
+macro instead.  See the EXAMPLES section below.  It is also important to
+remember that regardless of the architectures present in the filter, the
+syscall numbers used in filter rules are interpreted in the context of the
+native architecture.
 .P
 Starting with Linux v4.8, there may be a need to create a rule with a syscall
 value of -1 to allow tracing programs to skip a syscall invocation; in order