core: add SystemCallArchitectures= unit setting to allow disabling of non-native
architecture support for system calls

Also, turn system call filter bus properties into complex types instead
of concatenated strings.
networkd: correctly handle manager_free(NULL)
core: add a system-wide SystemCallArchitectures= setting

This is useful to prohibit execution of non-native processes on systems,
for example 32bit binaries on 64bit systems, this lowering the attack
service on incorrect syscall and ioctl 32→64bit mappings.
update TODO
core: make StopWhenUnneeded work in conjunction with units that fail
during their start job

https://bugzilla.redhat.com/show_bug.cgi?id=997031
update TODO
seccomp: fix build again if libseccomp is missing
nspawn: introduce --capability=all for retaining all capabilities
nspawn: add new --network-interface= switch to move an existing interface into the container
rtnl: drop "sd_" prefix from cleanup macros

The "sd_" prefix is supposed to be used on exported symbols only, and
not in the middle of names. Let's drop it from the cleanup macros hence,
to make things simpler.

The bus cleanup macros don't carry the "sd_" either, so this brings the
APIs a bit nearer.
rtnl: rename constructors from the form sd_rtnl_xxx_yyy_new() to sd_rtnl_xxx_new_yyy()

So far we followed the rule to always indicate the "flavour" of
constructors after the "_new_" or "_open_" in the function name, so
let's keep things in sync here for rtnl and do the same.
nspawn: --private-network should imply CAP_NET_ADMIN
nspawn: no need to subscribe to netlink messages if we just want to execute one operation
nspawn: check with udev before we take possession of an interface
everywhere: make use of new0() and macro() macros, and stop using perror()
everywhere: always use O_CLOEXEC where it makes sense
systemctl: fix exit statuses from is-active/is-failed

This was inadvertantly disturbed in e3e0314b when glob support was
added.