Unsealers should do a membrane-grant when unseal is invoked
If a sealed capability is wrapped, and then passed to the unseal
method of the sealer/unsealer, that method should perform a membrane grant of the capability that was sealed so that sealers/unsealers cannot be used to break the isolation model.