Lift cpuset Capsicum checks into a subroutine.

Otherwise the same checks are duplicated across four different system
call implementations, cpuset_(get|set)(affinity|domain)(). No
functional change intended.

MFC after: 1 week
Sponsored by: The FreeBSD Foundation