Allocate daemon listening ports

Mark the daemon listening ports as allocated in the `portallocator` in order to prevent containers from exposing this port themselves. This can be significant if #9078 gets merged as conflicting containers exposed port may no longer yield a bind error.
Shouldn't this be scoped to a specific ip?  you could bind the docker API on one interface but not all of them.