Document that Landlock exceptions are based on fd's

[mrcnski]

Hello again, really appreciate your work on Landlock. Some feedback:

One thing that wasn't clear to me until recently is that Landlock exceptions/whitelists are based on fd's and not paths.

In the sandboxing example and the path_beneath_rules example, paths are used for the exceptions, which can easily lead one to a false impression. It's partially my fault for not digging into the API to find out that it actually fundamentally accepts fd's. But even the add_rules methods do not make this clear, you have to click one more time into Rule.

Is it possible to document somewhere to make this a bit more explicit?

(This bit me recently. I wrote a design which assumed that another process can create new files at the whitelisted paths, and the sandboxed process could access them. Only after implementing it did I find out it didn't work.)