capsicum: fix checkpatch.pl warnings
capsicum: don't kmalloc(GFP_KERNEL) holding lock

In capsicum_rights_limit(), pre-allocate the capability wrapper
before taking the fdtable lock, as various kmalloc(GFP_KERNEL)s
involved could potentially sleep.  This changes capsicum_wrap()
to be capsicum_cap_alloc(), so it has no interaction with the
underlying file.
capsicum: fix incorrect stub function

For a non-Capsicum build, had two copies of stub
security_path_lookup() function; one should be stub
security_file_install().
capsicum: code tidy

Minimize diffs to original code.  A previous incarnation of the
fget() code needed an explicit struct capsicum_rights and thus
needed some code reordering.  Now that fgetr() and friends are
in place, the code can return to the previous structure.

Also fix a typo or two.
capsicum: fgetr() etc should always return ERR_PTR

Even in a non-Capsicum build, the fgetr() family of functions
should return an error pointer on failure (rather than just NULL).
capsicum: commonize fcntl rights setup
capsicum: use CAP_LIST_END for end of rights list