Make cap_rights_limit() work for CloudABI processes.

[ed]

Summary

Move the interesting bits of sys_cap_rights_limit() into
kern_cap_rights_limit(), so that we can call into it from the CloudABI
compatibility layer.

Extend CloudABI's fd_stat_put() to call into this new function when
limiting rights.

Test Plan

The Capsicum tests that are part of cloudlibc now pass:
https://github.com/NuxiNL/cloudlibc/tree/master/src/libc/sys/capsicum