Add SYS_CHROOT cap to unprivileged containers

Fixes #6103

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)