Currently boot is lenient about broken capability requirements during admin-only boot. We need a way to turn this off.

The current behavior is a fine default, as it allows users to boot a broken config in --admin-only and then fix the config. Without this the user is forced to rely on xml editing.

But there are other use cases for admin-only, for example in automated provisioning systems or testing systems, where the user can quite reasonably want a broken config to immediately generate a boot failure, as the automated system is not designed to handle incorrect initial input.