pledge(2): stdio: permit restricted profil(2) for moncontrol(3)

pledge(2): stdio: permit restricted profil(2) for moncontrol(3)

Currently, pledged '-pg' binaries get killed in _mcleanup() when they
try to disable profil(2) via moncontrol(3).

Disabling profil(2) is harmless.  Add profil(2) to the "stdio"
pledge(2) promise and permit profil(2) calls when the scale argument
is zero.  Enabling profil(2) remains forbidden in pledged processes.

This gets us one step closer to making '-pg' binaries compatible with
pledge(2).  The next step is to decide how to exfiltrate the profiling
data from the process during _mcleanup().

Prompted by semarie@.  Cleaned up by deraadt@.  With input from
deraadt@, espie@, and semarie@.

"Looks good" deraadt@
pledge(2) pieces ok semarie@