logger: enforce GID and CAP check on log flush