compose tree: Read in security.capability xattrs
compose tree: Read in security.capability xattrs

Per http://fedoraproject.org/wiki/Features/RemoveSETUID
many programs (famously /usr/bin/ping) switched to using
"file capabilities" instead of setuid.

rpm-ostree had code to specially handle SELinux labels, but was
discarding other xattrs.  Let's just whitelist reading in
security.capability.

Closes #14

cgwalters/rpm-ostree-cgwalters,cgwalters/rpm-ostree-cgwalters,giuseppe/rpm-ostree,mdshuai/rpm-ostree,tmp-user/rpm-ostree,giuseppe/rpm-ostree,giuseppe/rpm-ostree,mdshuai/rpm-ostree,giuseppe/rpm-ostree,tmp-user/rpm-ostree,tmp-user/rpm-ostree,mdshuai/rpm-ostree,tmp-user/rpm-ostree,cgwalters/rpm-ostree-cgwalters,mdshuai/rpm-ostree