daemon: support dropping capabilities

Right now, this feature will be used by default only for CentOS 7 packages.

Once systemd sockets are dropped in 5.0 (#485 (closed)), this mechanism will be used for all our packages, where it is currently unnecessary, since kresd gets the sockets from systemd and doesn't require any capabilities.