CRED: Constify the kernel_cap_t arguments to the capset LSM hooks