capmode: allow some FD-creating syscalls
capmode: allow some FD-creating syscalls

System calls that create new file descriptors without reference
to any global namespaces should be OK to allow.  For example, the
reference FreeBSD implementation of Capsicum allows pipe(2) and
socketpair(2).

In particular:
 - eventfd(2)/eventfd2(2) creates an FD for event notification, but
   there is no reference to a global object.
 - timerfd_create(2) creates an FD for timer pop notification without
   reference to any global objects.
 - epoll_create(2)/epoll_create1(2) creates an FD for grouped
   notifications without reference to any global object.

google/capsicum-test,google/capsicum-test,google/capsicum-test,google/capsicum-test