Initial applications isolation support using Linux namespaces.

src/nxt_runtime.h

@@ -59,6 +59,7 @@ struct nxt_runtime_s {
     uint32_t               engine_connections;
     uint32_t               auxiliary_threads;
     nxt_user_cred_t        user_cred;
+    nxt_capabilities_t     capabilities;
     const char             *group;
     const char             *pid;
     const char             *log;