In the refactor it looks like David made `struct cspace` an opaque type,
but kept the API using the same scheme where the user was responsible
for allocating the cspace. This commit adds allocation and free
functions that use the system-independent `cap_zalloc` and `cap_free`
calls.