Capability mode if LSM bit set; should be 0/1
Add an experimental seccomp-BPF implementation of capability mode

As well as any performance differences, this implementation also has
the following limitations:
 - policing of directory traversal in capability mode is not done, because the
   kernel is not aware of capability mode
 - kill(2) is banned completely, rather than being allowed only for signals sent
   to the same process.