Merge change 2230 into donut

* changes:
  runtime: Add CAP_SYS_NICE to the system server capabilities list so it can (eventually) move arbitrary threads into different cgroups