Enable copy_file_range(2) in capability mode.

[markj]

Summary

The system call takes two fds, and copies a range from one to the other.
We currently require CAP_READ for the source descriptor and CAP_WRITE
for the destination descriptor.

Test Plan

I wrote a small program which creates two files, writes some data to one,
and uses copy_file_range() to copy the data to the other. Verified that it
works if the program enter capability mode; verified that we get an error
if the source fd is missing CAP_READ or if the dst fd is missing CAP_WRITE.

[markj]

Fix sorting.