lxc: allow to keep or drop capabilities
    
    Added <capabilities> in the <features> section of LXC domains
    configuration. This section can contain elements named after the
    capabilities like:
    
      <mknod state="on"/>, keep CAP_MKNOD capability
      <sys_chroot state="off"/> drop CAP_SYS_CHROOT capability
    
    Users can restrict or give more capabilities than the default using
    this mechanism.