Add system.SetKeepCaps and system.ClearKeepCaps

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
SETUID/SETGID not required for changing user

It is no longer necessary to pass "SETUID" or "SETGID" capabilities to
the container when a "user" is specified in the config.

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
Merge pull request #6083 from bernerdschaefer/nsinit-drop-capabilities-after-changing-user

SETUID/SETGID not required for changing user