capability-util: Ignore unknown capabilities instead of aborting

capability_quintet_mangle() can be called with capability sets
containing unknown capabilities. Let's not crash when this is the
case but instead ignore the unknown capabilities.

Fixes d5e12dc75e

src/basic/capability-util.c

@@ -396,8 +396,9 @@ bool capability_quintet_mangle(CapabilityQuintet *q) {
 
         combined = q->effective | q->bounding | q->inheritable | q->permitted | q->ambient;
 
-        BIT_FOREACH(i, combined) {
-                assert((unsigned) i <= cap_last_cap());
+        for (unsigned i = 0; i <= cap_last_cap(); i++) {
+                if (!BIT_SET(combined, i))
+                        continue;
 
                 if (prctl(PR_CAPBSET_READ, (unsigned long) i) > 0)
                         continue;