capsicum_helpers: Add LOOKUP flag

[cem]

Summary

Add a helper routine for opening a directory that is restricted to being
used for opening relative files as stdio streams.

Test Plan

I think this will really help basic adaptation of multi-file programs to
Capsicum. Rather than having each program initialize a rights object and
ioctl/fcntl arrays for their root fd for relative opens, consolidate in the
logical place.

[cem]

Example use: https://reviews.freebsd.org/D7913