Implement tests in CCall and CReturn to check that 'local' capabilties are
never passed across protection-domain crossings via capability arguments or
return values.  This adds noticeable overhead that could be made lower
through ISA changes if desired.
Rename "OS" to "software" exceptions.

Teach CheriBSD the names of defined software exceptions.