capsicum_helpers: Add LOOKUP flag

Add a helper routine for opening a directory that is restricted to being
used for opening relative files as stdio streams.

I think this will really help basic adaptation of multi-file programs to
Capsicum. Rather than having each program initialize a rights object and
ioctl/fcntl arrays for their root fd for relative opens, consolidate in the
logical place.

Reviewed by: oshogbo@
Sponsored by: Dell EMC Isilon
Differential Revision: https://reviews.freebsd.org/D8743