systemctl: prefix list-units and list-machines output with a circle indicating a failure state

(Subject to --no-legend)
systemctl: sort local host entry before container in list-machines output
cgroup: it's not OK to invoke alloca() in loops
core: remount /sys/fs/cgroup/ read-only after we mounted all controllers

Given that glibc searches for /dev/shm by just looking for any tmpfs we
should be more careful with providing tmpfs instances arbitrary code
might end up writing to.
update TODO
machined: fix Kill() bus call on machine objects when "what" is specified as "leader"
machinectl: reimplement machinectl's "reboot" verb on top of "kill", and add new verb "poweroff"

There's really no point to send the reboot SIGINT from machinectl
directly, if machined can do that anyway. This saves code, and
makes machinectl network transparent for these verbs. And while we are
at it we can easily add a "poweroff" verb in addition to "reboot". Yay!