container: improve capability handling

This cleans up preserving caps for expansion and correctly sets privileged caps.

Signed-off-by: Ophestra <cat@gensokyo.uk>

container/container_test.go

@@ -537,7 +537,6 @@ func testContainerCancel(
 	containerExtra func(c *container.Container),
 	waitCheck func(ps *os.ProcessState, waitErr error),
 ) {
-	t.Parallel()
 	ctx, cancel := context.WithCancel(t.Context())
 
 	c := helperNewContainer(ctx, "block")