mention also how to set sys_chroot using filecap from cap-ng

Since that's the lib icecream uses, but filecap has no error reporting,
so setcap is better.