Enables SELFPROT_GENCODE as the default -protect_mask for UNIX and for STATIC_LIBRARY.
Fixes two problems that were blocking that:
- Adds temporary unprotection for update_syscalls().
- Fixes change_protection() to preserve +x (by delegating to make_{un,}writable()).
Issue: #3522