rbd: require global CAP_SYS_ADMIN for mapping and unmapping