capsicum: tidy comments and documentation

Use consistent terminology, in the hope of avoiding any confusion
with POSIX.1e capabilities:
 - 'capability FD' for a file descriptor (int) with associated rights
 - 'Capsicum capability' for a struct file object that wraps an
   underlying normal struct file
capsicum: remove duplicate checks for capability

capsicum_unwrap() calls capsicum_is_cap() and returns NULL if
not a capability, so no need to do the check in advance -- just
check for NULL underlying file instead.
capsicum-test: rename capsicum_tests/ to capsicum/

This subdir is under tools/testing/ so the _tests suffix seems
superfluous.
capsicum-test: don't run test if build fails
capsicum: add new file_install LSM hook

Add the hook framework for .file_install, which is intended to be invoked
when a new file that is derived from an existing file is installed into the 
file descriptor table.  This allows any security properties from the original
file to be migrated to the derived file.
capsicum: accepted socket should inherit rights

When processing accept(2), if the listening socket has rights associated
with it, the corresponding newly-created bound socket should inherit
those rights.
capsicum: tidy rights needed for openat(2)

For consistency use the equivalent rights set to FreeBSD (from the
flags_to_rights() function in kern/vfs_syscalls.c).
capsicum: move openat(2) to use file_install hook

Remove the special-case LSM hook for openat(2), and instead
use the general .file_install hook.

Check the the directory FD's rights at fget time, rather than
later (at derived file installation time).  This makes the
code simpler and also removes a (tiny) possible TOCTOU window.
capsicum: fix thread iteration

Don't forget to unlock on early exit from loop.
Use more appropriate lock.
Use simpler version of thread iteration.