capsicum: more details in documentation
capsicum: implement Capsicum as fallback LSM

Rather than implementing Capsicum as a new LSM module that only
implements the 4 new LSM hooks, instead have the Capsicum
implementations of those hooks be the fallback versions to use
when the active LSM doesn't provide the hook.  Given that no
current LSMs implement the new hooks, this means that the
Capsicum code is always used (provided CONFIG_SECURITY_CAPSICUM
is set), and can be combined with an ordinary LSM.