appc/spec: Collapse app and fileset manifests

This reworks the app image and fileset concepts to collapse them into a
single manifest, the App Image Manifest. The execution details are now
optional. It also describes a dependency retrieval/matching process
based on labels.
appc/spec: path_whitelist -> pathWhitelist
appc/spec: "app" -> "manifest"
appc/spec: minor cleanup
*: numerous updates to match spec

Changes to schema:
- removing FilesetManifest
- update example manifest to match that in spec
- splitting out App into a dedicated type embedded in AppImageManifest

Changes to tools:
- update aci writer (no more filesets)
- update actool build (no more filesets)
- update actool validate (no more filesets)
- update ace validator to use new types
- update rocket stage0/stage1 to new schema
- update ace app manifests to new spec
- fix a bug in build_aci (double compressing aci)
Merge pull request #241 from jonboulle/spec_app_images

appc/spec: Collapse app and fileset manifests
rkt run: acquire lock on container directory and record pid

stage0 acquires an exclusive advisory lock on the container directory,
leaving the fd open when executing stage1/init with the fd value stored in
the environment variable RKT_LOCK_FD.

stage1's fakesdboot.so shim prevents closure of RKT_LOCK_FD in nspawn by
replacing the close with a O_CLOEXEC fcntl, retaining the lock handle until
nspawn exits.

fakesdboot.so has also been modified to intercept the clone syscall from
nspawn, recording the pid of the container's PID 1 in
"/var/lib/rkt/containers/$cuuid/pid"

With these changes one can do things like:

query container status:
 #!/bin/bash
 shopt -s nullglob
 for c in /var/lib/rkt/containers/*; do
  [ -e "$c/pid" ] || continue
  flock --exclusive --nonblock "$c" /bin/true || {
   cpid=$(cat "$c/pid")
   nsenter --mount --uts --ipc --pid --root --wd --target "${cpid}" systemctl status
  }
 done

gc dead containers:
 #!/bin/bash
 shopt -s nullglob
 for c in /var/lib/rkt/containers/*; do
  [ -e "$c/stage1" ] || continue
  flock --exclusive --nonblock "$c" rm -Rf "$c"
 done