Add the ability to supply filters to watches set with keyctl

Add the ability to supply filters to watches set with "keyctl watch" and
"keyctl watch_session".

Signed-off-by: David Howells <dhowells@redhat.com>