add support to add or drop capabilities

Simple addition that let's you add or drop capabilities when you start a container. `SYS_ADMIN`, for example, is required if you want to use `systemd` inside your container.