replace: only include <sys/capability.h> with HAVE_POSIX_CAPABILITIES