dockerinit: machine container support

Detect when the app is a "machine container" with its own init process.
In this case, since upstart and systemd require running as PID 1, the
original dockerinit will have to "fork" a child long-running dockerinit
before exec-ing the real init.
dockerinit: set hostname

Set the hostname in dockerinit instead of with lxc utils.  libvirt-lxc
doesn't have a way to do this, so do it in a common place.
dockerinit: set IP address

Set the IP address in dockerinit instead of lxc utils, to prepare for
using libvirt-lxc.
remove pid from container state

Don't store the pid since nobody is using it.
lxc: create lxc container plugin

Create a container plugin infrastructure and move the lxc-specific code
to a plugin.
network: create dockernet plugin

Create a network plugin infrastructure and move the bridge creation code
to a new "dockernet" plugin.
network: add explicit iptables allows

Explicitly enable container networking for Fedora and other distros that
have a REJECT all rule at the end of their FORWARD table.
libvirt: create libvirt-lxc plugins

Create container and network plugins for libvirt-lxc.  If libvirtd is
running, use the libvirt plugins.  Otherwise use the dockernet and lxc
plugins.
dockerinit: privileged device cgroup access

When using libvirt-lxc in privileged mode, enable cgroup device access
from dockerinit, since libvirt doesn't support it.
dockerinit: workaround for libvirt directory leak