capsicum: generate SIGCHLD from pdfork()ed children

The FreeBSD definition of pdfork() states that the child process
doesn't generate SIGCHLD to the parent on termination.  However,
the naive implementation of this on Linux (namely omitting the
SIGCHLD value from clone_flags) has the side effect of removing
the ability to wait() for a child process.

The latter is probably more important that the former, so add
SIGCHLD to clone_flags as the signal to be emitted on child
termination.
capsicum: allow pdfork() in capability mode regards of params
capsicum: reinstate kfree of capability

This was accidentally dropped in commit ff2c1a5299.