Fixes #1959

* ThreadManager::WaitForAllThreads removed

* WaitForAllThreads was only called either in single threaded
  environments or just before all threads are joined anyway. As this
  doesn't add a useful synchronization point, it's removed.

* Formatting issue

* Thread Sanitizer satisfied

* More formatting issues

Refactor the multi-threading api to support
using custom user-provided thread factory
instead of always spawning POSIX Threads.

actions/runner-images#11101

Builds bindings with nanobind v2.7.0, which contains a few bug fixes and improvements.

getloadavg returns with -1 if cannot obtain load average, but the
current source casts the return value to size_t right away. The cast
result for such a case is probably maximum unsigned long int, so the
resizing of the res vector is certainly going to fail.

This change keeps the original return type of getloadavg and casts it
just before the resizing of the res vector.

Fixes #1962

* Detect and report ASLR status

Theoretically, we could just disable ASLR in `main()`,
but that seems to be disallowed by default
by some other security features.

Refs. #461

* Add a note about ASLR on other OS.

While ASLR is a useful security hardening feature,
it introduces unreproducible noise into benchmarks,
and we really really really don't want any noise,
especially easily avoidable one.

Unless prevented by some other security hardening,
we can disable ASLR for the current process,
and restart it, thus eliminating this noise.

Fixes #461

From a run of `pre-commit autoupdate`.