capsicum: ensure fcheck users unwrap capabilities

fcheck() and fcheck_files() return the struct file corresponding
to a file descriptor (without incrementing its refcount).  These
are mostly used in fget-like functions, which appropriately unwrap
a Capsicum capability to retrieve the underlying normal file.

However, there are some direct users of fcheck(); adapt these so
that they also call security_file_lookup to retrieve the underlying
file.

For generating the contents of /proc/<pid>/fdinfo/<fd>, use the
underlying file to get the file position and flags, but use the
wrapper file for invocation of .show_fdinfo (as Capsicum capabilities
have an implementation of this that shows the associated rights).
capsicum: use compound structure for rights

The full complement of Capsicum rights includes the allowed fcntl(2)
and ioctl(2) operations.  To reflect this, use a compound
struct capsicum_rights that includes these subrights.  This type
is opaque outside of the Capsicum code, and the syscalls to get/limit
rights take its components separately.

All fget-like annotations are updated to use a struct capsicum_rights
rather than a struct cap_rights; the latter is now only relevant on
the system call interface to Capsicum.

Note that struct capsicum_rights potentially includes allocated
memory (via the ioctls member), but this is only relevant when
retrieving the actual rights associated with a capability.  In other
words, when building the required rights for an fget()-like operation,
it is safe to have the struct capsicum_rights on the stack.

Also allow NULL to be used to indicate no special rights are needed.

In fs/namei.c, consistently use variable names:
 - rights: required rights for fd->struct file conversion
 - dfd_rights: actual rights of directory file descriptor, to ensure
   derived file descriptors inherit those rights.

Use global vars for particular rights sets that are widely used:
 - all_rights for all rights, in security/capsicum.c
 - lookup_rights for (just) CAP_LOOKUP, in fs/namei.c.
capsicum: police fcntl sub-rights
capsicum: regularize subrights to primary rights

When clearing the CAP_FCNTL or CAP_IOCTL primary right, also
ensure any associated subrights are also cleared.
capsicum: make integer types consistent

For Capsicum sub-rights use the same integer types as for
the system calls they constrain, specifically:
 - ioctl(2) syscall has unsigned int command argument
 - fcntl(2) syscall has unsigned int command argument.

So use int types rather than long types.

This change introduces a variance from the FreeBSD 10.x kernel
API, which uses u_long / uint32_t for ioctl/fcntl subrights.

(Those types are roughly consistent with ioctl(2) and fcntl(2)
syscalls on that platform, which take u_long / int command arguments
respectively).
capsicum: police ioctl sub-rights
capsicum: check supplied ioctl subrights present

Fix bug: was checking a random piece of stack for presence of
user-supplied ioctls rather than the syscall parameter.  Oops.