Add arch-independent CLIP OS recommendations for kernel self-protection