nspawn: add new --drop-capability= switch
valgrind: make running PID 1 in valgrind useful

Since valgrind only generates useful output on exit() (rather than
exec()) we need to explicitly exit when valgrind is detected.