set the capabilities so openvpn can make tun devices

Dockerfile

@@ -17,5 +17,6 @@ FROM registry.git.autistici.org/ai3/docker/chaperone-base
 COPY --from=build /go/bin/shapeshifter-dispatcher /usr/local/bin/shapeshifter-dispatcher
 COPY chaperone.d/ /etc/chaperone.d
 RUN apt-get -q update && env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-    openvpn netcat-openbsd iptables\
+        openvpn libcap2-bin netcat-openbsd iptables\
         && rm -rf /var/lib/apt/lists/*
+setcap cap_net_admin=ep /usr/sbin/openvpn