Add more flexible annotation __soaap_fd_permit(...) for expressing the system calls (libc wrapper functions) that may be called on a file descriptor. This will replace the __soaap_fd_read, __soaap_fd_write, ... annotations that previously did this.

This annotation is used in the same way:

__soaap_sandbox_persistent("parser")
int foo(int fd __soaap_fd_permit(read, write)) {
  read(fd, ...); // allowed/intended
  write(fd, ...); // allowed/intended
  close(fd, ...); // not annotated as being allowed and so will flag a warning
  ...
}

This annotation is now pretty much the same as the __soaap_limit_fd_syscalls annotation that was added to model Capsicum-style file descriptor restrictions. They should probably be merged into a single annotation but that might require some discussion.

The next step is to enable this __soaap_fd_permit annotation to work on struct members.