daemon: improve capabilities dropping

This fixes issues in the usage of libcap-ng to drop capabilities:
- capng_change_id() already applies the selected capabilities. Calling
  capng_apply() afterwards is pointless.
- In order to apply the bounding set, CAPNG_CLEAR_BOUNDING must therefore
  be passed to capng_change_id(). Might as well add CAPNG_DROP_SUPP_GRP
  to drop any supplementary groups.
- The return value of capng_change_id() must be checked to prevent
  continuing to run with unwanted capabilities in case of an error.

I have checked that with this patch applied iceccd runs with a bounding
set defined (pscap does not show the '+' sign anymore).