Allow a cheri_fd object to be destroyed without first revoking it -- destroy
implies revoke.
Clean up libcheri sandboxing slightly better in /bin/cheritest.