Provide Documentation on Securing ASP.NET Core Containers

I've discovered that you can run an ASP.NET Core image with a read-only file system but this requires you to turn off debugging and profiling support because otherwise you get an error. Full sample [here](https://github.com/RehanSaeed/ReadOnlyDockerTest).

```
docker run --rm --read-only -it -p 8000:80 -e COMPlus_EnableDiagnostics=0 my-asp-app
```

There are also a myriad of [settings](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) we can use in Kubernetes. Here is a sample Pod yaml:

```
apiVersion: v1
kind: Pod
metadata:
name: security-context-demo
spec:
securityContext:
runAsUser: 1000
fsGroup: 2000
volumes:
- name: sec-ctx-vol
emptyDir: {}
containers:
- name: sec-ctx-demo
image: gcr.io/google-samples/node-hello:1.0
volumeMounts:
- name: sec-ctx-vol
mountPath: /data/demo
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
add: ["NET_ADMIN", "SYS_TIME"]
```

- `allowPrivilegeEscalation` - Stops escalation of privlieges to super user.
- `readOnlyRootFilesystem` - Enables the read-only file system I talk about above.
- `runAsUser` - Run as a different user.
- `fsGroup` - Run as a different group.
- `capabilities` - Limit the linux capabilities available to the app.

As a linux noob, I'd really like more information and guidance on `runAsUser`, `fsGroup` and `capabilities` in particular. It would be ideal if a basic set of `capabilities` could be provided to get a hello world app running but also some description of what needs to be added to get additional features.