capsicum: allow cap_rights_get on O_PATH file

Use fget_raw() not fget() so that files opened with O_PATH
can still have capabilities retrieved.
capsicum: consistently macro SECCOMP_LSM code