dockerinit: drop capabilities

As recommended by @shykes in #2789, these are the parts from #2789 that can be merged before we decide how to structure the long-running dockerinit for libvirt-lxc support.

The common theme here is that we're moving functionality out of the lxc container backend and into dockerinit.

These changes have been taken from my [libvirt-lxc branch](https://github.com/jpoimboe/docker/tree/libvirt-lxc), and will be needed for docker to work with libvirt-lxc.  They will also make it easier to create other container plugins, since each plugin will have less to do.

/cc @alexlarsson 

EDIT: Removed network and container=lxc commits to make the PR easier to review.