always lock OS thread before dropping capabilities
always lock OS thread before dropping capabilities

this is actually already done in proc_starter/main.go, but this guards
us against improper re-use of the capability-dropping code

Signed-off-by: Craig Furman <82b4b6d2372fcea863d8fd21c02d40060d303650@pivotal.io>

cloudfoundry-incubator/garden-linux,cloudfoundry-incubator/garden-linux,cloudfoundry-incubator/garden-linux