Add dh_open. Remote send is all under cap_enter()
Provide dh_open_locked()

We call open_locked() in several parts of the code, and sometimes even
before we were acquiring dhs descriptor, therefor when dh_open() was
called with improper fd process crashed.

Mitigate this by creating dhsl (local) socket and replacing
open_locked() with capsicumized version, which takes socket as first
argument.