capsicum: Add prctl(PR_GET_*) to supported syscalls.

This allows cap_getmode() to be implemented in terms of
prctl(PR_GET_SECCOMP).
capsicum: initial implementation of cap_getrights

Add as a new syscall, and shuffle up the existing numbering
so it's next to cap_new.