Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Allow adding default capabilities to unprivileged addons

**What this PR does / why we need it**:

Allow adding the default set of capabilities back to unprivileged addons, when using the the default GCE PodSecurityPolicies. This is useful when paired with `drop: [ 'all' ]`

This is not a relaxation of permissions, as a pod that didn't touch capabilities (implicitly has the default set) is already allowed.

**Which issue(s) this PR fixes**:
Fixes https://github.com/kubernetes/dns/issues/254

**Release note**:
```release-note
NONE
```