Support capabilities bits in xattrs in layers

This adds support for detecting changes in the security.capability xattr, and enables the right flag in the tar commands to store/extract it.

This is needed for docker to work well with fedora packages. For instance, the Fedora httpd package has a /usr/sbin/suexec that has a capabilities bit set instead of being setuid. I verified this patchset by doing:
```
docker run -t -i mattdm/fedora bash
yum install -y httpd attr
bash-4.2# attr -l /usr/sbin/suexec 
Attribute "selinux" has a 32 byte value for /usr/sbin/suexec
Attribute "capability" has a 20 byte value for /usr/sbin/suexec
exit
docker commit ID
docker run -t -i ID bash
bash-4.2# attr -l /usr/sbin/suexec 
Attribute "selinux" has a 32 byte value for /usr/sbin/suexec
Attribute "capability" has a 20 byte value for /usr/sbin/suexec
```