Add support for defining package capabilities

[lordwelch]

Adds the ability to add filesystem capabilities to packages.
Specifically this allows running podman in rootless mode as newuidmap
and newgidmap are required in rootless mode for testing.
I have made a reimplementation of the programs here
https://gitea.narnian.us/lordwelch/Podman

The internal/cap package is modified from the libcap project to allow
cross-platform marshalling to/from the kernel vfs format to write squashfs
xattr values and for parsing the text format used with the setcap command

Adding a capability to a package happens in the package config using the Capabilities key and takes the same format as the setcap command see https://pkg.go.dev/kernel.org/pub/linux/libs/security/libcap/cap#FromText, the setcap/cap_from_text manpage or the FromText funciton in internal/cap/text.go in this repository

Here is an example of how it would be used with the newgidmap and newuidmap programs

{
    ...
    "PackageConfig": {
        "gitea.narnian.us/lordwelch/Podman/newgidmap": {
            "Capabilities": "CAP_SETGID+ep"
        },
        "gitea.narnian.us/lordwelch/Podman/newuidmap": {
            "Capabilities": "CAP_SETUID+ep"
        }
    },
    ...
}

Note this PR depends on gokrazy/internal#27 and will not compile without a sufficient replace directive or until it is merged and the go.mod file updated