Add support for OCI annotations

Annotations do not do anything by default but get passed through to the runtime,
which can be useful. I never metadata I didn't like...

Also fix sysctl to be a map in the validation, not an array. I can't see any
examples using this in LinuxKit, but this matches OCI so is correct.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>

test/test.yml

@@ -36,6 +36,9 @@ services:
           access: rwm
       pids:
         limit: 10
+    annotations:
+      annotate: this
+      org.opencontainers.example: "reserved annotation"
 files:
   - path: etc/docker/daemon.json
     contents: '{"debug": true}'