Privileged builds support

With this PR an admin can enable a repository to run its builds privileged. Builds for pull requests will not run privileged. This is exposed to the build via a `$DRONE_PRIVILEGED` environment variable, so that tests that require privileged can be disabled when running against a pull request.

This PR also includes some plumbing for writing tests against a fake docker client and fake Dockerfile writer. Currently it's only used for the build tests which were added to test only the privileged functionality. In the future they can be reused more generally.

Also adds a `-privileged` flag to the `drone` CLI.