sandbox/init: drop capabilities

During development the syscall filter caused me to make an incorrect assumption about SysProcAttr.

Signed-off-by: Ophestra <cat@gensokyo.uk>

sandbox/container.go

@@ -165,7 +165,7 @@ func (p *Container) Start() error {
 			syscall.CLONE_NEWNS,
 
 		// remain privileged for setup
-		AmbientCaps: []uintptr{CAP_SYS_ADMIN},
+		AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP},
 
 		UseCgroupFD: p.Cgroup != nil,
 	}