[PATCH 2/3] kernel: enable CONFIG_SECURITY_LOCKDOWN_LSM_EARLY