Seccomp: Tighten container capability checks a bit to align with kernel behaviour

[mihalicyn]

Let's tighten capability checks in mknod interception code to align this with what we have in the kernel. So, if mknod interception is enabled then only user with CAP_MKNOD in the container's initial user namespace can use it.

[tomponline]

Thanks @mihalicyn !