runas: don't allow capabilities other than setuid/setgid

Add a compile time assertion that capabilities other than setuid
and setgid are never granted to run-as.

This is a compile time assertion only. No new capabilities are granted
or removed.

Change-Id: Ie86d651b539cdfb6f3eaafef0d5d3b716610a220