capsicum: fill in more CAP_TODO entries

 - Need CAP_READ and CAP_WRITE for timer operations on PTP
   (Precision Time Protocol) timers, which are created from
   file descriptors that refer to a character device provided
   by the PTP device.

 - For perf_event_open(2), need CAP_WRITE on the FD provided as
   a group leader.  If PERF_FLAG_PID_CGROUP is specified in flags,
   need CAP_FSTAT on the FD passed in the pid argument (which
   is to an entry in the cgroupfd filesystem, identifying the
   relevant cgroup).

 - Need CAP_WRITE for ioctl(.., PERF_EVENT_IOC_SET_OUTPUT, fd).

 - Need CAP_READ for the control FD passed to cgroup.event_control
   (reading values from the control FD generates notifications on
   the corresponding event FD).

 - old_readdir() just needs CAP_READ.

 - For the file descriptor used to implement a FUSE filesystem,
   need CAP_READ|CAP_WRITE.

 - For perfmonctl(2) calls, need CAP_READ, CAP_WRITE or (new
   right) CAP_PERFMON appropriately.
   *Note: this change has not even been test-compiled as-yet.*

 - For spu_run(2) calls, and for any SPU context FD provided as
   the neighbor_fd argument to spu_create(2) (with the
   SPU_CREATE_AFFINITY_SPU flag), need CAP_READ|CAP_WRITE|CAP_MAPEXEC
   (PowerPC specific).
   *Note: this change has not even been test-compiled as-yet.*

Also add some comments for future passes about the syscalls that
trigger other fget() instances.