capsicum: add rights check for select(2)

Add a rights check at syscall entry for select(2) which retrieves
all of the file descriptors involved, and ensures they have
CAP_POLL_EVENT right.

Because this may involve arbitrarily many file descriptors, the
existing inline set of 6 file descriptor/struct file pairs that
are used for TOCTOU protection are no longer sufficient.

Therefore shift to a hybrid approach where the inline set of
6 pairs are used when they're sufficient, but a dynamically
allocated set of pairs is used when there are lots of file
descriptors to track.

Also remove the cred_transfer LSM hook, as it would become much
more complex in the presence of different allocation models, and
it's not actually used anyway.