Capability mode support using null namespace

[jackpot51]

This implements capability mode similar to cap_enter on FreeBSD, by introducing a null scheme namespace.

Entering this namespace removes any ability to open, unlink, chown, chmod, or exec, meaning that security properties of a process are easier to determine.

[jackpot51]

@Yoric you may be interested in this.

[jackpot51]

As a bonus, I also cleaned up the privelege switching logic in setreuid, setregid, and setrens

[Yoric]

I'd love to, but I'm swamped in work these months.