capsicum: dup(2) should preserve rights

When performing dup(2) on a capability file descriptor, the
new descriptor should also be a capability file descriptor with
the same rights.
capsicum: stay wrapped on fcntl(fd, F_DUPFD)

When duplicating a file descriptor via fcntl(fd, F_DUPFD)
the rights associated with the file descriptor should be
preserved, similarly to dup(2).

In addition to emitting the required rights, the fcntl_rights()
function now also returns whether the file should be unwrapped
or not.  A return value of true (use wrapped file) implicitly
expects that no rights are required (if the file doesn't get
unwrapped, no operations can be performed on it).