Better capability checking for if we can trace the kernel

Ref https://perf.wiki.kernel.org/index.php/Perf_tools_support_for_Intel%C2%AE_Processor_Trace#Adding_capabilities_to_perf

Right now we just check if the user is root, which covers most cases but isn't precise.

Read the linked perf wiki section first, then locate the existing check that treats root access as sufficient for kernel tracing. Define the capability-based behavior that replaces the broad root check, and consider the tracing cases that must be distinguished before verifying the change.

Written by the indexing model from the issue text.