scm: Require CAP_SYS_ADMIN over the current pidns to spoof pids.