capsicum: implement cap_rights_limit not cap_new

Initial implementation.

Shift semantics of Capsicum capability creation to match FreeBSD 10.x
style, where the rights of an existing file descriptor are changed
rather than creating a new restricted FD.

Also coalesce capsicum_cap_alloc/capsicum_cap_set as they are always
used together and this allows better error behaviour.