rights(4): fix our representation of the unused bits

[kevans]

Summary

The current format seems to be a little confusing, and the version of it
for index 0 was broken by the below-referenced commit. Turn our
UNUSED macros into a single mask for the entire unused range to prevent
future misinterpretation, since these are still useful to have around as
long as the top 7 bits are reserved for different uses / defined to be
zeroed out.

While we're here, add some static assertions to confirm that our
bookkeeping is in order for these, since it's not unexpected that one
might use CAP_UNUSED* to determine where they can slice off a new right.

Fixes: b165e9e3ea4e327fc ("Add fchroot(2)")

[oshogbo]

sys/kern/subr_capability.c

55

This reads a little bit weird - but maybe its just me.
Maybe:

CAP_ALL0 and CAP_UNUSED0 must cover all non-reserved bits

[kevans]

sys/kern/subr_capability.c

55

I like how that reads better, though I wonder if it'd be better to split into two and have one that separately asserts that the combination doesn't touch the reserved bits outside of the index.

[kib]

sys/sys/capsicum.h

297

I think this is similarly not obvious as the current state.

I suggest to go out and proivde CAP_UNUSEDXX for each unused bit in the word 1. It costs nothing to generate all of them, but much easier to pick one later.