Full infrastructure for permissions-dropping

Now, on a Linux system (where this is basically suitably old-school), it will
attempt to drop capabilities immediately to only use CAP_NET_RAW, which is the
only thing this program needs anyhow.  It also changes the installer and
documentation to enable the needed permission in the filesystem only, as well
as install the capabilities things to actually build / run this.

I don't know what kind of compatability problems this might introduce; it looks
like it works on most modern Linux versions (with a really loose definition of
"modern," as well) so I'm not too concerned.