Always expect cap_rights_limit() to fail when expanding rights
kmod: Use sys_cap_new rather than capsicum_install_fd
kmod: Don't attempt to widen rights on wrapping a capability