network: create dockernet plugin

Create a network plugin infrastructure and move the bridge creation code
to a new "dockernet" plugin.
network: add explicit iptables allows

Explicitly enable container networking for Fedora and other distros that
have a REJECT all rule at the end of their FORWARD table.
libvirt: create libvirt-lxc plugins

Create container and network plugins for libvirt-lxc.  If libvirtd is
running, use the libvirt plugins.  Otherwise use the dockernet and lxc
plugins.
dockerinit: privileged device cgroup access

When using libvirt-lxc in privileged mode, enable cgroup device access
from dockerinit, since libvirt doesn't support it.
dockerinit: workaround for libvirt directory leak