capsicum: Allow tgkill(self) in capability mode

This is important because abort(3) is usually implemented
as tgkill(getpid(), gettid(), SIGABRT).
capsicum-test: Ignore selftest subdirs
seccomp: improve consistency

 - Do comparison of return values masked by SECCOMP_RET_ACTION
 - Use cur_ret as variable name for current ret code in loop
capsicum: allow other arch_prctl(2) values

Fix bug introduced in 09a474c25aee; arch_prctl(ARCH_SET_FS,...) needs
to be supported in capability mode (it is used on process startup).