context: only append flags if we know the driver supports them

[nicks]

Background: before this change, if i tried to use GHA with an experimental driver, it would automatically append the flags

    --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host

even if the underlying driver did not support them.