LXC: Drop CAP_SYS_ADMIN by default

Considering the safety of an LXC container, it is prefered to drop the
SYS_ADMIN capability from a container to prevent allowing various systems
calls that can be escalate privileges of a container.
This patch adds sys_admin to the default value of the
lxc_drop_capabilities hvparam and add additional lxc.mount.entry lines
to an LXC configuration file which required to run a container with
dropping the SYS_ADMIN capability.

Signed-off-by: Yuto KAWAMURA(kawamuray) <kawamuray.dadada@gmail.com>
Reviewed-by: Hrvoje Ribicic <riba@google.com>