libsysdecode: Fix decoding of Capsicum rights

Capsicum rights are a bit tricky since some of them are subsets of
others, and one can have rights R1 and R2 such that R1 is a subset of
R2, but there is no collection of named rights whose union is R2. So,
they don't behave like most other flag sets. sysdecode_cap_rights(3)
does not handle this properly and so can emit misleading decodings.

Try to fix all of these problems:

• Include composite rights in the caprights table.
• Use a constructor to sort the caprights table such that "larger" rights appear first and thus are matched first.
• Don't print rights that are a subset of rights already printed, so as to minimize the length of the output.
• Print a trailing message if some of the specific rights are not matched by the table.

PR: 263165
Reviewed by: pauamma_gundo.com (doc), jhb, emaste
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D34874