capsicum: allow execveat(2) in capability mode