fix(podman): restore newuidmap/newgidmap file caps for rootless namespaces

pacman strips file capabilities, leaving rootless podman unable to set up
user namespaces (rc 125). Re-apply cap_setuid/cap_setgid on Arch.

roles/podman/tasks/main.yml

@@ -36,6 +36,20 @@
       After reboot, rootless Podman containers will have better network performance.
   when: not kernel_modules.stat.exists or (tun_loaded is defined and tun_loaded is failed)
 
+- name: Ensure newuidmap has setuid file capability
+  community.general.capabilities:
+    path: /usr/bin/newuidmap
+    capability: cap_setuid+ep
+    state: present
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Ensure newgidmap has setgid file capability
+  community.general.capabilities:
+    path: /usr/bin/newgidmap
+    capability: cap_setgid+ep
+    state: present
+  when: ansible_facts['os_family'] == 'Archlinux'
+
 - name: Enable Podman service
   ansible.builtin.systemd:
     name: podman.service