Add Capsicum-flavoured syscall test.

This test doesn't actually require Capsicum (it should build just fine on any platform with fcntl.h), but it does simulate what SOAAP should do with Capsicum.

First, we check that SOAAP allows us to open() files. Then, we invoke cap_enter(), which is modelled as restricting us to read, write, openat and exit system calls. Then we try to open() a file again (which isn't allowed). Then, we restrict an existing descriptor, disallowing all system calls on it but write(), and try to write to it.

Currently, SOAAP does not identify any of this behaviour as problematic.