write(1): Capsicumify

Enter Capsicum capability sandbox pretty early in this setuid program.

Some minor modifications were needed to cache directory fds and use
relative lookups.

Rights restriction of the stdio descriptors is unfortunately pretty messy
because we need an ioctl capability not present in the current libcapsicum
helpers (FIODGNAME).

Reviewed by: ed
Sponsored by: Dell EMC Isilon
Differential Revision: https://reviews.freebsd.org/D7999