Add a flag to reject privileged containers in the apiserver.

merge residue