actool: implement patch-manifest --revoke-capability
actool: implement patch-manifest --revoke-capability

"actool patch-manifest" was able to add an isolator of type
"os/linux/capabilities-retain-set" with --capability but was not able to
add an isolator of type "os/linux/capabilities-remove-set". This patch
adds this feature with --revoke-capability.

This will be useful for https://github.com/coreos/rkt/pull/2589

dgonyeo/spec,appc/spec,squeed/spec,dgonyeo/spec,squeed/spec,jonboulle/spec,3ofcoins/appc-spec,3ofcoins/appc-spec,jonboulle/spec,squeed/spec,appc/spec,dgonyeo/spec,jonboulle/spec,appc/spec,3ofcoins/appc-spec