types/capability: allow wildcard capability when presented in object form, add privileged-headers capability#1765