Add tests for restricting subrights of a non-capability
Check that we can retrieve (all) rights for a normal FD
Always use CAP_SET_ALL/CAP_SET_NONE rather than CAP_ALL/CAP_NONE.

FreeBSD has utterly clashing definitions of CAP_ALL/CAP_NONE between
9.x and 10.x:
 - in 9.x CAP_ALL/CAP_NONE are values
 - in 10.x CAP_ALL/CAP_NONE are functional macros.

So avoid using CAP_ALL/CAP_NONE directly.
Add test for retrieving ioctl(2) subrights without enough space.
Check that limiting primary rights leaves subrights unaffected
Check that subrights are inherited across openat(2)