cap_sysctl: correct typo from r347534-ish

operation & ~limit where limit is a bool is clearly not what was intended,
given the line prior. Correct it to use the calculated mask for validation.

The cap_sysctl tests should now be functional again.

lib/libcasper/services/cap_sysctl/cap_sysctl.c

@@ -316,7 +316,7 @@ sysctl_valid(const nvlist_t *nvl, bool limit)
 			 */
 			mask = limit ? (CAP_SYSCTL_RDWR |
 			    CAP_SYSCTL_RECURSIVE) : CAP_SYSCTL_RDWR;
-			if ((operation & ~limit) != 0 ||
+			if ((operation & ~mask) != 0 ||
 			    (operation & CAP_SYSCTL_RDWR) == 0)
 				return (EINVAL);
 			/* Only one 'operation' can be present. */