Enabling lsm=bpf by default would cause a performance regression
for lmbench/tcp and lmbench/syscall by 5%~11%.

Actually not all or most users want lsm=bpf and those who want
could enable it by cmdline. Thus here we will not enable lsm=bpf
by default.

The LSM config is aligned with upstream and ANCK v6.6. The
difference is that v5.10 does not yet have the Landlock LSM
module, this module was introduced in v5.14.
