default exclude list for secure-file-priv

Currently secure-file-priv="" and secure-file-priv=/ mean the same thing, all filesystem is accessible.

Let's have the first mean "almost all — reasonalble default, but without few hard-coded exceptions that nobody practically should notice". And if someone wants truly all, using any non-empty value for secure-file-priv would disable this behavior.

We'll start from /proc