Add a flag to reject privileged containers in the apiserver.