Add --cap-add and --cap-drop support

**Is your feature request related to a problem? Please describe.**
Unable to write to `/dev/mmcblkX` devices from within a toolbox container. This is necessary for various development environments where one may, such as in my case, be automating the provisioning of SDCARDs with custom images or firmware.

**Describe the solution you'd like**
I would like to be able to do something like: `toolbox enter firmware-dev --cap-add CAP_SYS_RAWIO` and `toolbox enter firmware-dev --cap-drop CAP_SYS_RAWIO` or do the same with any other Linux capability.

**Describe alternatives you've considered**
The alternative is to effectively reproduce what `toolbox` is doing with `podman` under the hood via a script wrapping `podman` directly. This is less than ideal just for the sheer amount of typing involved :stuck_out_tongue: