Kernel: Add a basic implementation of unveil()

This syscall is a complement to pledge() and adds the same sort of
incremental relinquishing of capabilities for filesystem access.

The first call to unveil() will "drop a veil" on the process, and from
now on, only unveiled parts of the filesystem are visible to it.

Each call to unveil() specifies a path to either a directory or a file
along with permissions for that path. The permissions are a combination
of the following:

- r: Read access (like the "rpath" promise)
- w: Write access (like the "wpath" promise)
- x: Execute access
- c: Create/remove access (like the "cpath" promise)

Attempts to open a path that has not been unveiled with fail with
ENOENT. If the unveiled path lacks sufficient permissions, it will fail
with EACCES.

Like pledge(), subsequent calls to unveil() with the same path can only
remove permissions, not add them.

Once you call unveil(nullptr, nullptr), the veil is locked, and it's no
longer possible to unveil any more paths for the process, ever.

This concept comes from OpenBSD, and their implementation does various
things differently, I'm sure. This is just a first implementation for
SerenityOS, and we'll keep improving on it as we go. :^)

Kernel/FileSystem/VirtualFileSystem.h

@@ -53,6 +53,7 @@
 #define O_CLOEXEC 02000000
 #define O_DIRECT 04000000
 #define O_NOFOLLOW_NOERROR 0x4000000
+#define O_UNLINK_INTERNAL 0x8000000
 
 #define MS_NODEV 1
 #define MS_NOEXEC 2
@@ -62,6 +63,7 @@
 class Custody;
 class Device;
 class FileDescription;
+class UnveiledPath;
 
 struct UidAndGid {
     uid_t uid;
@@ -134,6 +136,9 @@ public:
 private:
     friend class FileDescription;
 
+    const UnveiledPath* find_matching_unveiled_path(StringView path);
+    KResult validate_path_against_process_veil(StringView path, int options);
+
     RefPtr<Inode> get_inode(InodeIdentifier);
 
     bool is_vfs_root(InodeIdentifier) const;