capsicum: add capability mode to filter syscalls

Add a default implementation of the new .intercept_syscall LSM
hook for Capsicum capability mode.  This mode disables all system
calls that access global namespaces, such as the filesystem or
IP:ports.

Add the ECAPMODE errno value to indicate that a particular syscall
has been rejected due to capability mode.

The set of allowed syscalls is intended to be as close as possible
to those allowed in the FreeBSD 10.x implementation of Capsicum, to
ease the porting of Capsicum-aware applications.

Signed-off-by: David Drysdale <drysdale@google.com>