capsicum: mark some areas needing more work

The thread synchronization for applying capability mode
to all threads is not complete/correct, and the overall
approach could potentially be improved.

Mark both to ensure they don't get forgotten about.
capsicum: adjust CAP_SEEK rights usage

Sync with FreeBSD 10.x use of CAP_SEEK.  Roughly, this changes
the semantics from:
 - CAP_SEEK needed for any operation that alters the file position
   (even implicitly)
to:
 - CAP_SEEK needed for an operation that uses an arbitrary file
   offset, or which explicitly changes file position (lseek)

This also introduces the new shortcut CAP_PREAD / CAP_PWRITE
constants for read/write from arbitrary offset, as for pread(2) /
pwrite(2).
capsicum-test: run verbose when invoking debugger
capsicum: use CAP_MKNODAT for mknodat(2)
capsicum: allow kill(2) in capability mode

Allow kill(2) for the current process only.