policy/cap_userns: fix for kernels >= v5.12

Starting with Linux v5.12 CAP_SETFCAP is required to map UID 0/root.
This is due to kernel commit db2e718a4798 ("capabilities: require
CAP_SETFCAP to map uid 0").  In order to resolve this in the test
suite allow the cap_userns test domains to exercise the setfcap
capability.

Signed-off-by: Paul Moore <paul@paul-moore.com>
[OM: moved the new rule under "Rules common to both domains" and tweaked
 the subject]
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

policy/test_cap_userns.te

@@ -25,3 +25,6 @@ typeattribute test_no_cap_userns_t capusernsdomain;
 # Rules common to both domains.
 miscfiles_domain_entry_test_files(capusernsdomain)
 corecmd_exec_bin(capusernsdomain)
+
+# linux >= v5.12 needs setfcap to map UID 0
+allow capusernsdomain self:capability setfcap;