Fix privilege acquisition to work better with docker

[shinrich]

This problem was noted by people trying to make Traffic Server work in docker without complete privileges. The current code tries to grab all privileges at once. If any privilege fails, no privilege is granted. In the standard --privileged case only the CAP_NET_BIND_SERVICE is granted (of the privileges we care about), and for a basic reverse proxy that is the only capability needed, but the Traffic Server code would try to get all three of CAP_NET_ADMIN, CAP_NET_BIND_SERVICE, CAP_IPC_LOCK and fail. So the Traffic Server process running in the docker container could not listen on low ports.

This code change attempts to get the capabilities one at a time so that capabilities that can be granted will be granted.

[shukitchan]

[approve ci]

[shukitchan]

It has been working fine for us after these changes

[bryancall]

Cherry picked to 8.1.0

[jvgutierrez]

This is also needed when service hardening is performed via systemd, this commit was necessary to be able to bind on port 443 with the following systemd unit:

[Service]
ExecStartPre=/usr/local/sbin/update-ocsp-all
ExecStart=
ExecStart=/usr/bin/traffic_manager --run-root=/srv/trafficserver/tls --nosyslog
Restart=always
RestartSec=1
ExecReload=
ExecReload=/usr/bin/traffic_ctl --run-root=/srv/trafficserver/tls config reload
SuccessExitStatus=15

LimitNOFILE=500000
LimitMEMLOCK=90000

# Security options
ProtectKernelModules=yes
ProtectKernelTunables=yes
PrivateTmp=yes

RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK

CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_SETGID CAP_SETUID CAP_SYS_PTRACE CAP_FOWNER CAP_NET_BIND_SERVICE
SystemCallFilter=~@keyring @clock @cpu-emulation @obsolete @module @raw-io

# The entire file system hierarchy is mounted read-only, except for the API
# file system subtrees /dev, /proc and /sys
ProtectSystem=strict