rust/bwrap: Use cap-std

[cgwalters]

Part of https://github.com/coreos/rpm-ostree/issues/3832

[openshift-ci[bot]]

Skipping CI for Draft Pull Request. If you want CI signal for your change, please convert it to an actual PR. You can still manually trigger a test run with /test all

[cgwalters]

OK whee, problem was that try_exists() uses metadata() which will follow symlinks, and:

In case of broken symbolic links this will return Ok(false).

Tempting to add try_exists_nofollow() to cap-std-ext. symlinks are just a continuing source of pain in this port...