Add `pkg_emit_sandbox_call` to make a sandbox.

This call is intended to execute some function that operates with some
fd inside a capsicum enabled sandbox.

TODO: support various fd and various capabilities
TODO: think about some sort of isolation if capsicum is disabled
Merge branch 'capsicum-emit'