Capsicum rights are a bit tricky since some of them are subsets of
others, and one can have rights R1 and R2 such that R1 is a subset of
R2, but there is no collection of named rights whose union is R2. So,
they don't behave like normal flag sets.

The commit tries to address several problems:

• not all named rights are included in the caprights table due to the restrictive regexp used to collect them
• if the passed rights are not a subset of the whole table, nothing is printed
• if we print the name of every matching right, there is some redundancy in the output, e.g., a CAP_MMAP_R right would be printed as "CAP_MMAP_R,CAP_MMAP,CAP_SEEK,CAP_READ,CAP_SEEK_TELL".

Try to fix all of these problems:

• use a constructor to sort the caprights table such that "larger" rights appear first and thus are matched first
• don't print rights that are a subset of rights already printed, so as to minimize the length of the output
• print a trailing message if some of the specific rights are not matched by the table