Fix issue #1: set /proc/self/setgroups to deny.

It's necessary to do this for Linux to let you modify the
/proc/self/gid_map file (or else you get the error described in
issue #1 when you don't have CAP_SETGID).