renameat(2) behaviour when destination exists

[daviddrysdale]

If the destination of a renameat() operation exists, it will be removed. This implies that in this case something like the CAP_UNLINK right should be needed for the destination directory-fd -- but CAP_UNLINK isn't needed if the destination is empty.

Need to update the code for this case, presumably by caching the dest-fd rights and returning to them for an extra check when the processing discovers a non-empty destination.