Removed cdrtools binaries from nosuid list due to use of file capabilities
Improved root.nosuid handling and restored cdrtools policy

Capabilities of cdrtools binaries are not much better than suid,
but as more Gentoo packages move towards USE=filecaps, it is better
to let root.nosuid strip file capabilities as well, unless specified
otherwise.
Removed downloading and verification of stage3-*.CONTENTS

stage3 is verified using digest signatures anyway, so adapting
encoding every time Gentoo changes it makes no sense (GitHub: #9).