capsicum: mark some areas needing more work

The thread synchronization for applying capability mode
to all threads is not complete/correct, and the overall
approach could potentially be improved.

Mark both to ensure they don't get forgotten about.
capsicum: adjust CAP_SEEK rights usage

Sync with FreeBSD 10.x use of CAP_SEEK.  Roughly, this changes
the semantics from:
 - CAP_SEEK needed for any operation that alters the file position
   (even implicitly)
to:
 - CAP_SEEK needed for an operation that uses an arbitrary file
   offset, or which explicitly changes file position (lseek)

This also introduces the new shortcut CAP_PREAD / CAP_PWRITE
constants for read/write from arbitrary offset, as for pread(2) /
pwrite(2).
capsicum-test: run verbose when invoking debugger
capsicum: use CAP_MKNODAT for mknodat(2)
capsicum: allow kill(2) in capability mode

Allow kill(2) for the current process only.
capsicum: rename cap_getrights to cap_rights_get

For consistency with FreeBSD10.x Capsicum implementation, call
this syscall cap_rights_get() rather than cap_getrights().
capsicum: fail attempts to widen rights

For consistency with FreeBSD behaviour, explicitly fail attempts
to widen the rights of a capability rather than silently using
a subset.
capsicum: fix capability installation bugs

Fold capsicum_install_fd() into do_sys_cap_new(), which fixes
two long-standing bugs:
 - The struct file* passed to capsicum_install_fd() was outside
   of its read-side critical section (i.e. after rcu_read_unlock())
 - Both capsicum_install_fd() and do_sys_cap_new() were incrementing
   the refcount on the underlying file.

Also export sys_cap_new instead of capsicum_install_fd.