capabilities: initialize supplementary groups only when doing a setuid()