We now how the bootstrap in the binary itself.
This doesn't remove the installed bootstrap files, though, for backwards
compat: existing configs may be referencing the system path.
Setcap causes problems (like issue #1007), so stop using it (and undo
the permission override on upgrade) and instead set capabilities via the
systemd services.
(This also fixes some AssertFileNotEmpty declarations that were in the
wrong places).
