Don't drop CAP_FOWNER in the container.

 Also sorts the list of allowed capabilities.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)