Escalate through Linux file capabilities

A binary carrying cap_setuid or cap_dac_read_search grants root-equivalent power without any SUID bit, and defenders rarely audit it.