execveat: add sys_ni.c entry for execveat
seccomp: Add some basic selftests

Add basic selftests of secure computing mode, both STRICT and
FILTER.
capsicum: diff minimization

Tweaks mostly to reduce diffs against upstream.
capsicum: split documentation

Split Capsicum documenation into separate chunks for
capability FDs, capability mode and process descriptors.
capsicum: split out capability mode implementation

Move code related to capability mode into capsicum-capmode.[ch].
execveat: self-tests for file in non-dot subdir

This is a particularly important test case for shell script
invocations, which need the full filename of the file so that
the invoked script executable can find and load the script
file.
capsicum: Explain different fget() variants
capsicum: checkpatch.pl warnings
execveat: only use filename relative to AT_FDCWD

Also remove unused parameter left over from previous incarnation
of the code (when it was an explicit fexecve(2)).
execveat: Don't need to expose may_open()
capsicum: whitespace changes only