Code makes no difference handling '--socket-activated' and
'--dbus-activated', it only makes things more obscure.
Moreover, on a systemd enabled system, dbus activation actually
starts systemd service anyway, so there is really no big difference.

since implicit files provider can't be enabled by default anymore.

Resolves: SSSD#5022

This patch removes capabilities that aren't needed at all.

Some (if not all) of remaining capabilities can be probably
avoided with proper code changes, but currently those are needed.

Examples (not limiting) of those caps usage:
 - CAP_DAC_OVERRIDE (@additional_caps@): access to /var/log/sssd,
   to /var/lib/sss/pipes/private/* (sssd:sssd owned sbus-monitor/dp
   sbus sockets)
 - CAP_CHOWN: `chown_debug_file()` in case of monitor activation
 - CAP_SETUID/CAP_SETGID: drop privs in case of monitor activation,
   switch_creds (in particular, sssd_kcm executing krb5_child
   for ticket renewal)
 - CAP_FOWNER: chmod(mem-cache)

It's not that clear about 'CAP_KILL'. When 'sssd_be' terminates
child process, it either still runs under root (so uid matches and
no caps needed) or it dropped privs already and have lost CAP_KILL
anyway. Another thing is 'monitor' signalling responders and
providers that could be running under 'sssd' while 'monitor'
itself runs under 'root'.

This allows to remove CAP_FOWNER.

'PermissionsStartOnly' is deprecated but used for consistency
with other unit files.