capsicum: add rights for users of user_path_at

Users of user_path_at with a dfd of something other than AT_FDCWD may
need more precise rights than just CAP_LOOKUP on the dfd.

 - For fanotify_mark(2), need CAP_FSTAT.
 - For fstatat(2), need CAP_FSTAT.
 - For faccessat(2), need CAP_FSTAT.