Add CAP_SYS_RESOURCE to capability bounding set. (#9569)

This mitigates failures in the eBPF plugin. The issue is a `setrlimi()` call we're making to allow us to call `memlock()`. The proper fix here is dependent on whether we can prove that we actually need to call `memlock()` or not (I suspect we do not _need_ to but it improves measurement accuracy, in which case it should be optional). If we can, then this is also a fix and not a mitigation. If we can't, then the fix is to get rid of those calls in the eBPF plugin and remove this othewise unneeded capability from our bounding set.