sanebox: fix landlock sandboxing IAB edgecases

i don't fully understand it. but adjusting the Inh capability set breaks things like gocryptfs. i think it isn't necessary: if we set E alone, and no-new-privs, then that gets us the same guarantees.

pkgs/additional/sanebox/sanebox

@@ -870,7 +870,7 @@ capshonlyIngestCapability() {
   # therefore, only grant it those capabilities i know will succeed.
   if capsh "--has-p=cap_$1" 2>/dev/null; then
     if [ -z "$capshCapsArg" ]; then
-      capshCapsArg=cap_$1=eip
+      capshCapsArg=cap_$1=ep
     else
       capshCapsArg=cap_$1,$capshCapsArg
     fi