securebits/check_keepcaps.c: Add comments about cap_get_flag may return -1

In RHEL7.0(3.10.0) the value of CAP_LAST_CAP in linux/capability.h is 36, it is
greater than in the capability.h which is used to create
libcap.so(libcap-2.22-8) and that value is 34. Then cap_get_flag returns -1, and
errno is set to EINVAL. Add comments to make this clear.

Signed-off-by: Zeng Linggang <zenglg.jy@cn.fujitsu.com>
Acked-by: Jan Stancek <jstancek@redhat.com>