CAP_LAST_CAP in linux/capability.h doesn't always match what the kernel
actually supports.  If the kernel supports fewer capabilities, then a
cap_get_flag for an unsupported capability returns -EINVAL.

Recognize that, and don't fail when initializing capabilities when this
happens, rather accept that we've reached the last capability.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>