capsicum: add right for setns(2)

Use new CAP_SETNS right for calls to setns(2).

Also allow unshare(2) in capability mode (as an equivalent
effect can already be achieved by the appropriate flags
to clone(2)).
capsicum: use namespace-aware uid in pdkill