capsicum: require no_new_privs for capability mode

As for seccomp-bpf mode, require that the no_new_privs bit
is set before entering capability mode.