Add the ability to generate ICICLE safely

This patch allows users to generate ICICLE while preserving the
pristine content of the original image generated by the native
installer.  This avoids embedding the results of "first boot" type
tasks such as the generation of SSH keys and the initialization of
log files.

This is particularly useful when generating images for cloud targets
using custom install scripts and no customization in the TDL itself.

It works by running the ICICLE step against a temporary qcow2 disk
image which uses the "real" image as a backing store.  All writes
are done to the qcow2 image which is discarded when ICICLE generation
is complete.

This features is a new option in the config file and is disabled
by default.

For the moment it only works with RPM/Anaconda distros but could
likely be extended to support any OS for which ICICLE can be generated.