Runtime should support NoNewPrivs

[xibz]

• should allow privilege escalation when false
• should not allow privilege escalation when true