Fix typos and add ioctls_list_alloc.

No more panic when building libc on a vkernel
Implement real capability mode

Capability mode is a mode in which access to global namespaces is
restricted. The mode is enforced as a credential flag for process
stored in the ucred structure. For now, the flag is not (yet)
exported via proc_kinfo.

This mode is inherited by child process (not yet implemented).
This commit adds syscalls to enter capability mode and restrict
rights associated to filedescriptors