(prerequisite: gh-98608)

Currently, the optional restrictions on subinterpreters are:

• disallow fork
• disallow subprocess
• disallow threads
• defaults for "isolated" interpreters: (no fork, no subprocess, no threads)

When we added those, were were being a bit conservative. At this point we should adjust to the following:

• disallow fork
• disallow exec
• disallow threads
• disallow daemon threads
• defaults for "isolated" interpreters: (no fork, no exec, no daemon threads, regular threads OK)

That means we would stop disallowing subprocess (even if fork or exec are disabled). We'd add an option for "exec". We'd also add an option for daemon threads and disable only those (rather than all threads) by default for isolated interpreters.

CC @gpshead

• PR: gh-98610: Adjust the Optional Restrictions on Subinterpreters #98618