capsicum: fix rights for *at(2) operations

Operations relative to a directory file descriptor may need
more rights than just CAP_LOOKUP, so add an extra-parameter
version of user_path_create/user_path_at so that dfd to struct
path conversion can check those rights.

Fix openat(2) rights because (doh) read/write modes are not
actually a bitmask.

Also improve const-correctness in fs/namei.c.