basic: Fix capability_ambient_set_apply for kernels < 4.3

basic: Fix capability_ambient_set_apply for kernels < 4.3

https://github.com/systemd/systemd/pull/14133 made
capability_ambient_set_apply() acquire capabilities that were explicitly
asked for and drop all others. This change means the function is called
even with an empty capability set, opening up a code path for users
without ambient capabilities to call this function. This function will
error with EINVAL out on kernels < 4.3 because PR_CAP_AMBIENT is not
understood. This turns capability_ambient_set_apply() into a noop for
kernels < 4.3

Fixes https://github.com/systemd/systemd/issues/15225