networkd: fix setting dns from dhcp
nspawn: require /etc/os-release only for init

/etc/os-release is expected for the case for booting a full system, and
need not be required for thin container execution.
fstab-generator: Create fsck-root symlink with correct path

This was noticed in Brussels at the hackfest. The fstab-generator currently
creates a broken symlink pointing to itself in
/run/systemd/generator/local-fs.target.wants/ for systemd-fsck-root.service
build-sys: add check-includes build target and script
build-sys: move python helpers to tools directory

Note that make-man-rules.py is missing in EXTRA_DIST=, this patch
fixes this mistake too.
includes: remove duplicate includes

Found by the new check-includes make target.
exec: Add SELinuxContext configuration item

This permit to let system administrators decide of the domain of a service.
This can be used with templated units to have each service in a différent
domain ( for example, a per customer database, using MLS or anything ),
or can be used to force a non selinux enabled system (jvm, erlang, etc)
to start in a different domain for each service.
exec: Ignore the setting SELinuxContext if selinux is not enabled
exec: Add support for ignoring errors on SELinuxContext by prefixing it with -, like for others settings.

Also remove call to security_check_context, as this doesn't serve anything, since
setexeccon will fail anyway.
nspawn,man: use a common vocabulary when referring to selinux security contexts

Let's always call the security labels the same way:

  SMACK: "Smack Label"
  SELINUX: "SELinux Security Context"

And the low-level encapsulation is called "seclabel". Now let's hope we
stick to this vocabulary in future, too, and don't mix "label"s and
"security contexts" and so on wildly.
update TODO
nspawn: add new --share-system switch to run a container without PID/UTS/IPC namespacing