Forbid setuid/setgid binaries in capability mode