keep `DAC_OVERRIDE` after changing the uid/gid

Currently, the FUSE protocol doesn't send the process supplementary groups. This causes some use cases to fail, for instance (user belongs to "wheel"):

# mkdir -m 0770 testdir
# chgrp wheel testdir
# su user -c "touch testdir/file"

it should succeed but fails with "Permission denied".

The Kata team also reported a database init failure due to lack of support of supplementary groups:

"kata database failed due to permission issue in mssql/mariadb/pssql: cannot create directory '/var/lib/mysql/data': Permission denied"

Although the actual solution requires a modification of the FUSE protocol, and Miklos is working on a solution. In the meantime, to work around this, we can set the DAC_OVERRIDE in the effective set after changing the credentials. We are allowed to set the capability because we only change the effective user ID, so we still have the 'DAC_OVERRIDE' in the permitted set.

An alternative workaround is to set SECBIT_NO_SETUID_FIXUP to avoid clearing the caps effective set, but it has the disadvantage that we must be careful and drop FSETID (and probably a few others) or we risk introducing some security bugs, like CVE-2022-0358 [0].

The biggest drawback of this workaround, it will not work on top of NFS (and probably also CEPH) and might be limited to local filesystems.

[0] !77 (merged)

This is a workaround for #59 (closed)

closes #30 (closed)