[MERGE] Use libcap instead of direct linux capability syscalls

The kernel interface, while some aspects of it is much simpler is also
not really meant to be called directly by applications.

The attached patch approximates the same functionality using libcap.
Differs slightly in how it sets the permitted capabilities to be kept on
uid change (explicit instead of masked), but end result is the same as
setting the capabilities won't work if these were not allowed.