Add docker's add/drop capabilites

Add docker's add/drop capabilites
Given that capabilities are a multiple, could we do:

```
CapabilityType string
// ... enumerated list of caps

// Capabilities represent POSIX capabilities that can be added or removed to a running container.
Capabilities struct{
  Add []CapabilityType
  Drop []CapabilityType
{
```

?  Anyone who wants capabilities will know that docker has CapAdd/CapDrop - anyone who doesn't will at least have a chance of knowing it.

The Kube API -> Docker API argument I don't think is very strong, because the Docker API was chosen around cmd flags (and I'll go yell at the person at Red Hat who used the shorter name in the API :)).  I doubt anyone will ever fail to understand what the structure does who knows anything about Capabilities.

----- Original Message -----
> > @@ -319,6 +319,9 @@ type Container struct {
> >  	Privileged bool `json:"privileged,omitempty"`
> >  	// Optional: Policy for pulling images for this container
> >  	ImagePullPolicy PullPolicy `json:"imagePullPolicy"`
> > +	// Optional: Capabilities for container.
> 
> These should only be the POSIX capabilities. I don't want to mix in other
> capabilities. IMO, our internal abstraction is a hindrance more than
> anything.
> 
> I do agree that it should be guarded. Don't have to be in this PR, IMO.
> 
> I'd actually prefer that we drop all by default and require a whitelist
> instead of Docker's default whitelist, which I think is what
> [Rocket](https://github.com/appc/spec/blob/master/SPEC.md) does.
> 
> I agree that we shouldn't necessarily always follow Docker verbatim, but
> there is a usability cost to incompatibility, so we should choose our
> battles carefully.
> 
> It is unfortunate that the Docker API pointlessly abbreviated these field
> names.
> 
> ---
> Reply to this email directly or view it on GitHub:
> https://github.com/GoogleCloudPlatform/kubernetes/pull/2933/files#r21877181