capsicum: add CAP_PTRACE
The capability will allow the ptrace(2) on the procdesc.
pdfork(2): add PD_PTRACE_CAP flag
If the flag is not specified, the process descriptor returned by either
pdfork(2) or pdopenpid(2) has the CAP_PTRACE capability disabled.
ptrace(2): add PT_PROCDESC request modifier
ptrace.2: document PT_PROCDESC