Add a /usr/include/cheri to hold libcheri headers.
Install libcheri headers in /usr/include/cheri rather than /usr/include,
as we're growing them rather quickly.
Define a static 'CHERI system class' which can be invoked by sandboxes to
perform basic system services -- and will in the future presumably provide
access to additional objects on demand.  For now, implement two services: a
'hello world' test method, which prints a typical hello world string, and a
'puts' method able to print an arbitrary string from the sandbox on stdout.

Sandboxes will call cheri_system_setup() with code/data capabilities passed
into the sandbox in order to initialise local stubs that call out to the
class.  After that, they can invoke method functions.

Remove support for pre-__capability compilers rather than implement
variations of these code paths in CHERI assembly.
Implement CHERI system class stubs / setup routine in libc_cheri so that
they are available to all sandboxed applications.  A sandbox must be
delegated access to the system class before system-class methods can be
used.
Update demo applications for new location of libcheri's sandbox.h.
Implement cheri-helper methods that will invoke the system class's
'helloworld' and 'puts' methods.

While here, be slightly more thorough about not delegating 'NULL'
capabilities to a sandbox -- instead use cheri_zerocap().
Teach cheritest how to use cheritest-helper's 'helloworld' and 'puts'
methods, which in turn invoke system-class methods.

While here, prefer cheri_zerocap() to NULL to avoid delegating undesired
rights to sandboxes.
Merge branch 'master' of https://github.com/CTSRD-CHERI/cheribsd