execute: Call capability_ambient_set_apply even if ambient set is 0

The function capability_ambient_set_apply() now drops capabilities not
in the capability_ambient_set(), so it is necessary to call it when
the ambient set is empty.

Fixes #13163