A zero CAP_CAP caused duplicate CAPAB to go undetected, allowing a
mismatch between what is sent out via ENCAP GCAP and what applies locally.
A zero CAP_TS6 allowed server connections without SID (with a valid
connect block).
Specifically, what this capability manager does, is map keywords to
calculated bitmasks. These bitmasks are allocated at runtime, so that
the any managed capability index can be manipulated by modules.
Modules should call capability_orphan() when orphaning capabilities. This
makes it so that bitmasks aren't reallocated, except for cases where the
capability is the same.