Support for user namespaces

This exposes UID namespace support.  A new command line option (--uidmap)
maps a set of virtual UIDs to which the application within the container
is confined.  The application could potentially be the root in the
container but unprivileged on the host.

Addresses issue #2918

Docker-DCO-1.1-Signed-off-by: Dinesh Subhraveti <dineshs@altiscale.com> (github: dineshs-altiscale)