namei(9): allow NDINIT_ATVP() lookups in capability mode

[kib]

Summary

NDINIT_ATVP() initializes dirfd to AT_FDCWD, which is denied for a
process already in cap mode.  Since NDINIT_ATVP() is a special lookup
operation performed by the kernel, it should be allowed to proceed for
the paths beneath vp.

Fabricate a pseudo dirfd value that is an unused placeholder,
which fails the AT_FDCWD comparison and allows the lookup to proceed in
cap mode.

Reported by:    ivy