`TestGetPermissionError…` is not reliable

Running unit tests manually using hack/ci/ci.sh, I see fairly reproducible failures of TestGetPermissionError….

Adding debug logging shows that even after supposedly dropping the capabilities, they are =ep.

Starting getWrappedMain with runtime.LockOSThread() seems to reliably help — but that is not robust against starting other goroutines and the like. Is there something better we can do to reliably drop capabilities for the whole process? Go’s os.Exec seems not to have a flag for that.