capsicum: pass through rights associated with dfd

When performing openat(2) relative to a directory file
descriptor, that dfd may have restricted rights.  These
rights should be passed to the .path_lookup LSM hook, so
that path traversals that attempt to access / or .. in
a lookup relative to a capability can be bounced.

Modify path_init() to additionally return the rights associated
with the dfd (or CAP_ALL if the dfd is irrelevant to the lookup).

Plumb the dfd rights through follow_link() and __vfs_follow_link()
so they are available to the main link_path_walk() function, which
can then pass them as an argument to .path_lookup.

Update the Capsicum implementation of the .path_lookup hook so
that it:
 - polices when either against a capability dfd, or in capability
   mode
 - returns -ENOTCAPABLE rather than -ECAPMODE for consistency with
   FreeBSD.