hardening: Minimal capabilities for container

[jakub-bochenski]

It would be nice if the agent container could run with capDrop: -ALL

Note that JetBrains requires some capabilities for it's devcontainers implementation: https://youtrack.jetbrains.com/issue/IJPL-234876

Reducing capabilities for other containers would also reduce the attack surface, but the agent one seems the most important

[jakub-bochenski]

Note: sudo and chown require specific capabilities

[jakub-bochenski]

I've tried adding capDrop, but vscode devcontainers don't start if I do