`bst-here` capabilities are too narrow

[See original issue on GitLab](https://gitlab.com/BuildStream/buildstream/-/issues/156)
In GitLab by [[Gitlab user @tlater]](https://gitlab.com/tlater) on Nov 15, 2017, 18:08

Currently `bst-here` runs docker only with `CAP_SYS_ADMIN`, although bwrap also explicitly requires `CAP_SYS_CHROOT`, `CAP_NET_ADMIN`, `CAP_SETUID` and `CAP_SETGID` for various purposes. Adding these permissions does not seem to be enough, however, presumably there are some permissions bwrap needs that it doesn't check for explicitly.

This causes errors when bwrap attempts to mount system directories. A test case that mimics what buildstream runs internally for example is:

```
/src> bwrap --ro-bind / / --unshare-user --unshare-pid --proc /proc /bin/bash
Can't mount proc on /newroot/proc: Operation not permitted
```

When running docker with `--privileged` this is not an issue, since all capabilities are granted. We should find the capabilities that are required beyond the above and change the script to provide them.

Locate the bst-here script and inspect how it starts Docker and bubblewrap (bwrap). Reproduce the shown bwrap command and compare it with the capabilities granted by the script, then identify the additional permissions needed for the mount and namespace operations. Done means the script grants the required capabilities and the reported system-directory mount failure is resolved.

Written by the indexing model from the issue text.