capsicum: add fget_raw_no_unwrap

This fget variant does not unwrap capabilities, and so should
not be used in any context where the resulting struct file is
used in anger.

Currently only used when transferring a capability file descriptor
across a UNIX domain socket.
capsicum: expose sockfd_lookup_light()
capsicum: add TOCTOU record for FDs transferred over socket

The sendmsg(2) and sendmmsg(2) syscalls can transfer file
descriptors across a UNIX domain socket.

Do the same kind of processing as occurs in __sys_sendmsg()
(from net/socket.c) to get at the cmsghdr structures associated
with the control part of the message, then store fd/struct file
mappings as usual.  However, there are no particular rights
that need to be checked for the transferred file descriptor(s).