makesyscalls.lua: add a CAPENABLED flag

The CAPENABLED flag indicates that the syscall can be used in capsicum
capability mode. It is intended to replace capabilities.conf.

Reviewed by: kevans, emaste
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D31349

(cherry picked from commit 6945df3fff57a9606f8c8a4e3865def3a0e915e7)