[SSSD] [sssd PR#5504][+Ready to push] limit process capabilities and sanitize usage of experimental '--with-sssd-user=' option