commoncap: don't alloc the credential unless needed in cap_task_prctl