Support for user namespaces

This exposes UID namespace support.  A new command line option (--uidmap) maps a set of virtual UIDs to which the application within the container is confined.  The application could potentially be the root in the container but unprivileged on the host.

This is still missing tests but wanted to push it anyway to get some feedback.  Testing requires the latest kernel (kernel.org 3.13 or Fedora 20).

Addresses issue #2918
Docker-DCO-1.1-Signed-off-by: Dinesh Subhraveti <dineshs@altiscale.com> (github: dineshs-altiscale)