Maintain a whitelist of capabilities rather than droplist

This fixes 6/18 vulnerability

Docker-DCO-1.1-Signed-off-by: Dinesh Subhraveti <dineshs@altiscale.com> (github: dineshs-altiscale)
Use libcontainer cap drop method

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Update close fd issues for lxc

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael)
Merge pull request #6527 from subhraveti/cap-whitelist

Maintain a whitelist of capabilities rather than droplist