capsicum: terminate name resolution on error

If the newly-added .path_lookup check fails in link_path_walk(),
ensure the walk is properly terminated.
fs: add O_BENEATH_ONLY flag to openat(2)

Add a new O_BENEATH_ONLY flag for openat(2) which restricts the
provided path, rejecting (with -EACCES) paths that are not beneath
the provided dfd.  In particular, reject:
 - paths that contain .. components
 - paths that begin with /
 - symlinks that have paths as above.
selftests: Add test of O_BENEATH_ONLY & openat(2)

At simple tests of openat(2) variations, including examples that
check the new O_BENEATH_ONLY flag.
capsicum: remove .path_lookup LSM hook

Now that O_BENEATH_ONLY is available, remove the .path_lookup
LSM hook that Capsicum was using to ensure that path traversal
did not escape the starting directory.
capsicum: remove unnecessary dfd_rights propagation

With the .path_lookup LSM hook invocation removed, the follwing
functions no longer need the dfd_rights:
 - link_path_walk()
 - nested_symlink()
 - follow_link()
capsicum: expose cap_rights_is_all()
capsicum: Police path traversals by setting LOOKUP_BENEATH_ONLY

Turn on the LOOKUP_BENEATH_ONLY for path traversals
 - when the process is in Capsicum capability mode
 - when the dfd the lookup is relative to is a Capsicum
   capability file.

At present these involve direct calls to Capsicum functions
(specifically capsicum_in_cap_mode() and cap_rights_is_all() on
the DFD's rights) rather than any kind of LSM hook mechanism.

This change (and it predecessors) also induce a change in behaviour
compared to FreeBSD 10.x, in that a failure from path traversal will
be reported as EACCES rather than ENOTCAPABLE.
capsicum: fix some long lines
seccomp: remove now-unused test case