kernel - Add per-process capability-based restrictions

kernel - Add per-process capability-based restrictions

* This new system allows userland to set capability restrictions which
  turns off numerous kernel features and root accesses.  These restrictions
  are inherited by sub-processes recursively.  Once set, restrictions cannot
  be removed.

  Basic restrictions that mimic an unadorned jail can be enabled without
  creating a jail, but generally speaking real security also requires
  creating a chrooted filesystem topology, and a jail is still needed
  to really segregate processes from each other.  If you do so, however,
  you can (for example) disable mount/umount and most global root-only
  features.

* Add new system calls and a manual page for syscap_get(2) and syscap_set(2)

* Add sys/caps.h

* Add the "setcaps" userland utility and manual page.

* Remove priv.9 and the priv_check infrastructure, replacing it with
  a newly designed caps infrastructure.

* The intention is to add path restriction lists and similar features to
  improve jailess security in the near future, and to optimize the
  priv_check code.