capsicum: order syscall table alphabetically
capsicum: add more syscalls

Specifically, add the necessary rights for:
 - finit_module
 - readahead
 - recvmmsg
 - sendmmsg
 - socket
 - socketpair
 - syncfs
 - sync_file_range
 - umask
 - vmsplice
capsicum: only pre-allocate capability in openat(2)

Remove the fd_alloc LSM hook, which was where the previous
code pre-allocated a capability (struct file and struct capability)
on the off chance that a new struct file might need wrapping.

Instead, do the pre-allocation specifically for the case of
openat(2), which is the only syscall other than cap_new(2)
that can generate a new capability.