capsicum: use varargs fget() variants

To minimize codebase impact, particularly for a non-Capsicum build,
use varargs variants of fget() and friends:
 - fgetr(fd, ...): convert FD to struct file, incrementing its refcount.
 - fgetr_light(fd, fput_needed, ...): convert FD to struct file,
   only incrementing refcount if fdtable is shared.
 - fdgetr(fd, ...): convert FD to struct fd.
 - fgetr_raw(fd, ...): convert FD for real (non O_PATH) file to struct
   file, incrementing its refcount.
 - fgetr_raw_light(fd, fput_needed, ...): convert FD for real (non
   O_PATH) file to struct file, only incrementing refcount if fdtable
   is shared.
 - fdgets_raw(fd, ...): convert FD for real (non O_PATH) file to struct
   fd.
 - sockfd_lookupr(fd, err, ...): convert FD for socket to struct socket,
   incrementing the file refcount.
 - user_path_atr(fd, name, flags, path, ...): convert FD to struct path.
 - timerfd_fgetr(fd, f, ...): convert timer FD to struct fd.

In a Capsicum build, fgetr(fd, ...) macros to _fgetr(fd, ..., 0)
which builds a struct capsicum_rights instance and calls on to
fget_rights(fd, &rights).

In a non-Capsicum build, fgetr(fd, ...) just macros to fget(fd), so
there is no impact on the generated code.

This allows the vast majority of fd->struct file conversions to use
the fget*r() variants, with minimal change.  However, there are still
some instances that need to use the full fget_*_rights() functions:
 - Code that propagates rights from a parent to a child fd (e.g.
   openat(2) or accept(2) uses fget_*_rights())
 - Code that needs to check sub-rights as well as primary rights,
   specificially ioctl(2) and fcntl(2), still needs to use the full
   struct capsicum_rights version.
 - Code that has significantly different rights depending on parameters
   (e.g. mmap(2), mknodat(2), io_submit(2)) continues to build an
   explicit rights structure.

Also make order of arguments consistent: always have required rights as
final argument.