systemctl: refuse --capsule=foo with --system

Fixes the following assertion:
===
systemctl --capsule=hoge --system reboot
Assertion 'runtime_scope == RUNTIME_SCOPE_USER' failed at src/shared/bus-util.c:479, function bus_connect_transport(). Aborting.
Aborted (core dumped)
===

Follow-up for 56cb74c3cd.

src/systemctl/systemctl.c

@@ -1075,6 +1075,10 @@ static int systemctl_parse_argv(int argc, char *argv[]) {
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                        "Cannot access user instance remotely.");
 
+        if (arg_transport == BUS_TRANSPORT_CAPSULE && arg_runtime_scope != RUNTIME_SCOPE_USER)
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                       "Cannot access system instance with --capsule=/-C.");
+
         if (arg_wait && arg_no_block)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                        "--wait may not be combined with --no-block.");