icecc-create-env: avoid tar looking at /etc/passwd

If we invoke tar with --numeric-owner, it won't try to read /etc/passwd.
This has the minor benefit of not having to worry about this access in
the SELinux policy (or other MAC policies).
daemon: improve capabilities dropping

This fixes issues in the usage of libcap-ng to drop capabilities:
- capng_change_id() already applies the selected capabilities. Calling
  capng_apply() afterwards is pointless.
- In order to apply the bounding set, CAPNG_CLEAR_BOUNDING must therefore
  be passed to capng_change_id(). Might as well add CAPNG_DROP_SUPP_GRP
  to drop any supplementary groups.
- The return value of capng_change_id() must be checked to prevent
  continuing to run with unwanted capabilities in case of an error.

I have checked that with this patch applied iceccd runs with a bounding
set defined (pscap does not show the '+' sign anymore).