Set no-new-privs before setting seccomp-capsicum mode
Check that no-new-privs is required for entering capability mode