Let services do capability checks.

Looking at the discussion of the basic design considerations around CapabilityServiceSupport at [1] I don't see anything that argues against this.

[1] http://lists.jboss.org/pipermail/wildfly-dev/2015-June/004159.html