Support granular capabilities

Rather than only supporting lxc.cap.drop, support
should be added for lxc.cap.keep. This would enable
the principle of deny-by-default, with an ability to
granularly enable capabilities.

Allusion to the necessity for this feature is already
noted in lxc_template.go

Resolves issue #2080