Support allow_caps

[unixfox]

Right now, you can't run a binary that listen to a port under 1024 because the binary is ran with a non root user (which is expected).

Allow the ability to specify capabilities like the exec plugin: https://developer.hashicorp.com/nomad/docs/deploy/task-driver/exec#allow_caps

[tgross]

Looks like this should be feasible by adding to the AmbientCaps field for the syscall.SysProcAttr. We'd probably want an allowlist/denylist for the plugin configuration as well. I'll mark this for roadmapping, but it would probably not be too huge a lift if someone from the community wanted to tackle it too.

(Internal ref https://hashicorp.atlassian.net/browse/NMD-1096)