Merge "Set NO_NEW_PRIVS on zygote init"