capsicum: Tidy up syscall table

Remove mention of autogenerating the table from a .js source.

Make the syscall processing closer to a pure function, by explicitly passing
in the structure to be filled in.
capsicum: Safer memory usage

Only allocate the per-thread storage in the two cases it
is actually needed:
 - on syscall entry, when in capability mode, to store syscall
   parameters for TOCTOU protection
 - on fd_alloc hook, to pre-allocate a capability for use if/when
   the new fd gets installed.

For safety, explicitly zero out the per-thread storage and the
capability structure on allocation, and ensure that copying
the per-thread storage doesn't share pre-allocated capabilities.

Simplify security credential management hooks.
capsicum: tidy up code

Add comment on mode 3 of seccomp.

Consistently name local variables (cap for struct capability, capf
for struct file that is a capability).

Rename sys_cap_new_impl() to do_sys_cap_new() for consistency with
other kernel implementation functions.

Put related parts of capsicum_pending_syscall together.
capsicum: tweak syscalls allowed in capability mode

Synchronize which syscalls are allowed with FreeBSD 9.1.

Disallow bind/connect/fchdir (despite the existence of the CAP_BIND,
CAP_CONNECT and CAP_FCHDIR rights).

Allow various other syscalls.