This adds a new system call, fchroot(2). The idea is to use it
with Capsicum for oblivious sandboxing, but for now it's just
a chroot(2) that takes a fd instead of path.
This also modifies chroot(8) utility to add "-d", so one can
do eg "chroot -nd 5 /bin/bash 5< /compat/jammy".