Add docker's add/drop capabilites

Add docker's add/drop capabilites
These should only be the POSIX capabilities. I don't want to mix in other capabilities. IMO, our internal abstraction is a hindrance more than anything.

I do agree that it should be guarded. Don't have to be in this PR, IMO. 

I'd actually prefer that we drop all by default and require a whitelist instead of Docker's default whitelist, which I think is what [Rocket](https://github.com/appc/spec/blob/master/SPEC.md) does.

I agree that we shouldn't necessarily always follow Docker verbatim, but there is a usability cost to incompatibility, so we should choose our battles carefully. 

It is unfortunate that the Docker API pointlessly abbreviated these field names.