Add options to enable/disable capabilities and devices (checkboxes?)

[emibcn]

It would be good to be able to check/uncheck which capabilities are permitted to each container. It should came with default ones selected and advertise that changing it is dangerous: only do it if you know what you're doing. And the same (or something similar) for allowed devices.

Same as the other issue, I can work on it and then do a pull request.