id128: when taking user input for a 128bit ID, validate syntax

Also, always accept both our simple hexdump syntax and UUID syntax.
cgroup: do not allow manipulating the cgroup path of units within the systemd:/system subtree
cryptsetup: warn if /etc/crypttab is world-readable
cryptsetup: warn if keyfiles are world-readable
cgroup: make cg_pid_get_path() work properly for co-mounted controllers and normalized named hierarchies
man: we need to be more careful with the unit search paths we document

We generally document the suggested paths, not the paths possible in
weird, non-standard setups. We do this in order to not confuse
administrators/users unnecessarily and to push people to install things
into the same directories on all distributions.

We are PID 1 after all, the really basic building block of the OS.
Unlike for an app there's very little benefit in being entirely
relocatable.
build-sys: add makefile stub link to nss-myhostname/
man: improve documentation for specifiers
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services
update TODO