Update comments in cheri_syscall_authorize(), and prefer checks against $pcc
rather than $c0.  Both work fine, but as we tend to key privileges to code
capabilities in the CPU, the same for OS privileges seems to make sense.

When we block a system call from a sandbox, drop into the kernel debugger if
requested by security_cheri_debugger_on_exception.

Include user permissions in $c0.