Add file_ns_capable() helper function for open-time capability checking