Support for user namespaces

This exposes UID namespace support.  A new command line option (--uidmap)
maps a set of virtual UIDs to which the application within the container
is confined.  The application could potentially be the root in the
container but unprivileged on the host.

Addresses issue #2918

Docker-DCO-1.1-Signed-off-by: Dinesh Subhraveti <dineshs@altiscale.com> (github: dineshs-altiscale)
Add -x flag to optimize away UID translation

If -x flag is not set, UIDs of the files in the image are assumed to match the specified UID
mappings and no UID translation is performed.

Images with UIDs already translated can be produced by simply committing a container created
with -x flag:

    $ docker commit $(docker run -d -x --uidmap="100000:0:10000" centos true) centos_uid100000
    $ docker run --uidmap="100000:0:10000" -i -t centos_uid100000 bash

Docker-DCO-1.1-Signed-off-by: Dinesh Subhraveti dineshs@altiscale.com (github: dineshs-altiscale)
Add --private-uids option to simplify default use

--private-uids option is introduced to simplify the use of virtual UID space.
A default host UID range is chosen to create the container rather than the user
having to specify a mapping.  If user specifies mappings using --uidmap, they
take precedence.  In either case, the semantics of -x remain the same:

    $ docker commit $(docker run -d -x --private-uids centos true) centos_private_uids
    $ docker run --private-uids -i -t centos_private_uids bash
    # cat /proc/self/uid_map
             0     100000      10000