refactor the LXC start command arguments into a method; explicitly override aa_profile and cap.drop if supplied