Handle POSIX.1e libcap security API
Enabled by default in configure, needs explicit --without-libcap to disable.
When enabled, master becomes cyrus before forking services or running START
actions, and asks to retain the ability to bind privileged ports.
We need privileges for setrlimit
Call it before becoming cyrus. Since it is supposed to be inherited after fork,
don't #ifdef/#ifndef HAVE_LIBCAP and do it right at the start.
Handle POSIX.1e libcap-ng security API
Enabled by default in configure, supersedes libcap if present. Both libcap-ng
and libcap can be disabled separately (--without-libcap/--without-libcap-ng)
or altogether (--without-system-capabilities).
System capabilities support is enabled by default and needs to be explicitely
disabled if user does not have/want it.