Add a new member variable `caps` that if not `None` indicates the capabilities to retain, i.e. all other capabilities not specified will be dropped via `bubblewrap` (`--cap-drop`). Add corresponding tests.
vmdk
qemu
org.osbuild.qemu