Capsicum sandboxes don't really stop.

Once we enter capability mode, we don't leave it.
Move cap_enter annotations around, fix whitespace.

From the perspective of the userspace program, cap_enter() is an atomic operation that takes effect on return from the system call. Move the SOAAP annotations around to make this clearer, also removing the need to explicitly permit cap_enter in this test case (since we only declare entry into the sandbox on return from cap_enter).

This also required/allowed me to fix some whitespace issues caused by the conflicting editor settings of various contributors. :)
Add LLVM triple to llvm-lit configuration.

We will need this for platform-specific XFAIL declarations.
Test more Capsicum features.

This will only compile on platforms that support Capsicum (currently just
FreeBSD), so we provide an XFAIL directive for other platforms.