execveat: test O_CLOEXEC file descriptors

In particular, trying to execveat() a script accessed via a file
descriptor with O_CLOEXEC should fail, because the interpreter
cannot get to the file.
execveat: add verbose option to selftest

If VERBOSE is set in environment, print out argv[].
capsicum: openat with __FMODE_EXEC needs CAP_FEXECVE
execveat: allocate space for full path
execveat: use do_filp_open() for all cases

Still have an unsightly special case to explicitly police that
O_PATH file descriptors should not be fexecve()-able.
execveat: fail O_PATH fexecve() and O_CLOEXEC scripts

Mark exec operations against file descriptors that are
O_CLOEXEC with a new interp_flags value.  If this flag
is set, fail any of the binfmt operations that involve
an interpreter (which will normally need to open the
file via a now-inaccessible filename).

Add a new lookup flag to indicate that O_PATH file descriptors
are not acceptable as a companion to an empty path (with the
AT_EMPTY_PATH option).
execveat: expect failure for O_CLOEXEC fds

If a script is execveat()ed via an O_CLOEXEC file descriptor,
it should fail with ENOENT.
execveat: emit failcount from selftest
capsicum: do_filp_open can return wrapped file

When do_filp_open() is passed a non-AT_FDCWD file descriptor
and an empty path (with LOOKUP_EMPTY set), the returned file
may be the Capsicum wrapper rather than the real underlying
file.

If the file just gets immediately installed into the fdtable
(as is the case for do_sys_open) then that's what's needed.

However, when performing do_open_execat() for the new
execveat(2) syscall, the struct file will be used directly,
so needs to be unwrapped before use.