cap_sysctl: correct typo from r347534-ish

operation & ~limit where limit is a bool is clearly not what was intended,
given the line prior. Correct it to use the calculated mask for validation.

The cap_sysctl tests should now be functional again.