Don't drop CAP_FOWNER in the container.

 Also sorts the list of allowed capabilities.

Fixes #5887

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)