Drop capabilities after changing user/group

At the moment, `nsinit.Init()` will fail if a user is specified in container.json but `CAP_SETGID` and `CAP_SETUID` are not present in the capabilities list.

This changeset drops capabilities after changing the user/group (instead of before), allowing the user to be set without also granting the contained process setuid/gid capabilities.