Check necessity of `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities.

[jmuchovej]

Binding to port 53 seems to require CAP_NET_BIND_SERVICE.

Further, having ZeroTier run within the container appears to require CAP_SYS_ADMIN and CAP_NET_ADMIN. Based on my understanding of cap_add – CAP_SYS_ADMIN should include CAP_NET_ADMIN... but, CAP_SYS_ADMIN also gets pretty close to root's capabilities – which (ideally) isn't necessary.

• Need to develop a better understanding of CAP_SYS_ADMIN.
• Need to develop a better understanding of CAP_NET_ADMIN.
• Test what capabilities are required for running CoreDNS, strictly.
• Test what capabilities are required for running ZeroTier, strictly.