feat(rtx-xdp): drop caps when done with them

Author: t-nelson

turbine/src/xdp.rs

@@ -206,6 +206,13 @@ impl XdpRetransmitBuilder {
             caps::drop(None, CapSet::Effective, cap).unwrap();
         }
 
+        // for a cap to be in the `ambient` set, it must be in both `inheritable` and
+        // `permitted` sets, so we can skip explicitly clearing it here
+        caps::clear(None, CapSet::Inheritable)
+            .map_err(|e| format!("failed to clear `inheritable` cap set: {e}"))?;
+        caps::clear(None, CapSet::Permitted)
+            .map_err(|e| format!("failed to clear `permitted` cap set: {e}"))?;
+
         let router = router_result?;
         let maybe_ebpf = maybe_ebpf_result.transpose()?;