compose tree: Read in security.capability xattrs

Per http://fedoraproject.org/wiki/Features/RemoveSETUID
many programs (famously /usr/bin/ping) switched to using
"file capabilities" instead of setuid.

rpm-ostree had code to specially handle SELinux labels, but was
discarding other xattrs.  Let's just whitelist reading in
security.capability.