Use libcap for saving CAP_NET_ADMIN (if --transparent is given) over a setuid(). We don’t need CAP_NET_BIND_SERVICE as the listening sockets are established before dropping root.
