Document how to use raw sockets, low ports, etc. without running setcap on bin/python

This is a pretty low-priority thing but the `setcap` approach mentioned in astral-sh/python-build-standalone#576 is a little undesirable for a few reasons. On our side it prevents us from ever having `$ORIGIN`-relative shared libraries, and on the user side, you need to do it every time you upgrade the Python binary and it breaks ptrace (`strace`, `gdb`, etc.). I want to write some recommendations for how to accomplish this goal without `setcap`.

I made an attempt in the comments in that issue but it seemed not to work out right, so the task here is to actually try this out and have a worked example.

(While at the moment we switched libpython to static linking, I don't love committing to this. It might be a good idea to turn libssl, libX11, etc. into shared libraries at some point and I don't want to block ourselves from doing that. Also, some of the workarounds we've talked about re statically linking libpython involve dynamically loading a fake/empty libpython, which would have to be just as `$ORIGIN`-relative as a real one.)