actually, we don't need suid at all, we can just setcap on the cython wrapper
compile /usr/bin/ooniprobe directly
- this is actually safer, since we detect #13581 at build-time and compile the good version into the wrapper
- OTOH the previous test_2 links to ooni, so it would not be able to detect a faulty ooni on the end-user's machine