capsicum: Support custom syscall checks and anonymous mmap

Support custom functions to check specific syscalls, allowing checks
that don't fit into the capsicum_table.js format. The first is mmap,
where we only enforce capability checks if it's not an anonymous map.

TEST=seccomp.test customcall.mmap
BUG=none

Change-Id: I7e73cb5a312711b717012d9a951629c6a4987ebd
Signed-off-by: Meredydd Luff <meredydd@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/26375
Reviewed-by: Kees Cook <keescook@chromium.org>