kernel: Fix various compilation error introduced by capsicum API
kernel: capsicum fix invalid check for ioctls lists

ioctl whitelist can be NULL even if CAP_IOCTL is granted
it means that all ioctls are allowed
kernel: avoid leaking information during lookup in capability mode

* When NCL_CREATE/NLC_DELETE/NLC_RENAME_DST, returns ENOTCAPABLE
  instead of EEXIST/ENOENT if the needed rights are not granted

* When an error is returned during the lookup, check if no race has
  occurs. If we are not under the sandbox root anymore, due to
  rename race, returns ECAPMODE instead of the actual error.
kernel: make filecaps_shallow_copy public