Add __soaap_limit[_fd]_syscalls() annotations.

These annotations mean "from here on, you can only call certain syscalls" (optionally, with respect to a particular file descriptor. __soaap_limit_syscalls() could be applied to cap_enter(), a seccomp-bpf registration or some other sandbox-entry primitive. __soaap_limit_fd_syscalls() could be applied to cap_rights_limit() or some other sandbox-specific primitive.

Hopefully, these annotations will become redundant as SOAAP learns the semantics of Capsicum, seccomp-bpf and perhaps other mechanisms too.