Fix an incorrect word in `--help-syscalls`
Follow --bindfs to check real path permissions

This allows nested `--bindfs` like:

  --bindfs /dst/a /src/c
  --bindfs /dst/a/foo /src/d
    # lrun previously will check permission of /dst/a/foo,
    # which is wrong. now lrun checks /src/c/foo