LSM: SafeSetID: fix use of literal -1 in capable hook