capsicum: expose a few Capsicum functions

Expose the functions that are used for mapping between capabilities
and the underlying normal file:
 - capsicum_is_cap()
 - capsicum_unwrap()
 - capsicum_install_fd()
capsicum-test: retire in-kernel unit tests

The Capsicum in-kernel tests don't test that much, and the
majority of the test functionality can be performed from
a loadable module instead.
capsicum: export fget_raw_light()
capsicum: improve documentation

Add a first draft of an overall description document, and
reference it in Kconfig entries.
capsicum: sort out CONFIG_* dependencies

Move the path_lookup LSM hook into the CONFIG_SECURITY_PATH
section, and mark the dependency in Kconfig for Capsicum.
capsicum: add intercept_syscall LSM hook

Add a general intercept_syscall LSM hook rather than explicitly
triggering the Capsicum syscall interception.  This is more general,
but note that the hook still needs to be explicitly enabled by
the application with a prctl(PR_SET_SECCOMP, SECCOMP_MODE_LSM).