Change the prototype of cap_ioctl_check

It's better to let the locking mechanism of filedescripto
opaque and let the code in sys_capability.c handle that,
instead of spreading it around the kernel
Add assertion to check that ioctl list is valid
Convert more holdfp to holdfp_capcheck