[RFC] vpn: Restrict connman-vpnd capabilities