Switch to github.com/moby/sys/capability

[kolyshkin]

Currently a draft pending #776 merge.

The github.com/moby/sys/capability package is a fork of the original
one, which is apparently no longer maintained.

For changes since the fork took place, see
https://github.com/moby/sys/blob/main/capability/CHANGELOG.md

Related to: moby/sys#183

Also, bump Go to 1.21 as this is a minimally supported version for
github.com/moby/sys/capability, and update CI accordingly.

---

Note that "workaround for RHEL6" is removed for a number of reasons.
Feel free to choose the one you like the most, either is sufficient:

1. /proc/sys/kernel/cap_last_cap is available since RHEL 6.7
   (kernel 2.6.32-573.el6), released 9 years ago (2015-07-22).

2. It incorrectly returns CAP_BLOCK_SUSPEND (36), which was only added
   in kernel v3.5 and was never backported to RHEL6 kernels. The
   correct value for RHEL6 would be CAP_MAC_ADMIN (33).

3. As far as upstream kernels go, /proc/sys/kernel/cap_last_cap was
   added in kernel v3.2, and a correct value depends on the kernel
   version. It could be CAP_WAKE_ALARM (35), added to kernel v3.0, or
   CAP_SYSLOG (34), added to kernel v2.6.38, or possibly a lesser value
   for even older kernels.

[thaJeztah]

@kolyshkin looks like you need to fix vendoring;

go build -tags "" -ldflags "-X main.gitCommit=012d045 -X main.version=0.9.0" -race -o oci-runtime-tool ./cmd/oci-runtime-tool
go: inconsistent vendoring in /home/runner/work/runtime-tools/runtime-tools:
	github.com/moby/sys/capability@v0.4.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
	github.com/moby/sys/capability@v0.3.0: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod

	To ignore the vendor directory, use -mod=readonly or -mod=mod.
	To sync the vendor directory, run:
		go mod vendor

[thaJeztah]

@kolyshkin gentle nudge 😄

[kolyshkin]

@thaJeztah @cyphar sorry for the delay; this is now ready

[thaJeztah]

Note that "workaround for RHEL6" is removed for a number of reasons.
Feel free to choose the one you like the most, either is sufficient:

No strong opinions; I know Moby has dropped support for RHEL6 a long time ago, and I'm not sure if anyone would still be depending on this (I highly doubt other runtimes would still take RHEL6 into account).

[thaJeztah]

LGTM

[thaJeztah]

@kolyshkin this needs another rebase 🙈

[kolyshkin]

Rebased

[kolyshkin]

Note that "workaround for RHEL6" is removed for a number of reasons.
Feel free to choose the one you like the most, either is sufficient:

No strong opinions; I know Moby has dropped support for RHEL6 a long time ago, and I'm not sure if anyone would still be depending on this (I highly doubt other runtimes would still take RHEL6 into account).

I just did a detailed writeup on this because removing a hack always looks suspicious and raises some questions (and so I'm answering those in advance). I'm 100% sure this is no longer needed (even for RHEL6).

[thaJeztah]

LGTM

[rhatdan]

LGTM