capsicum: allow openat_beneath to be cleared

Forcing the value to be latched-on in capability mode
can be policed in the BPF filter program.
capsicum: require no_new_privs for openat_beneath changes

Don't want a task with openat_beneath=1 to execve()
a setuid program and then have that setuid program be
affected by its (unprivileged) parent's restrictions.
capsicum: move openat_beneath into atomic flags

Make the openat_beneath flag a member of the atomic_flags
bitmask, protected by task->sighand->siglock.