Separate out graphdriver mount and container root

This separates out the directory as returned from the graphdriver (the "base" fs) from the root filesystem of the live container. This is necessary as the "diff" operation needs access to the base filesystem without all the mounts that the running container needs (/.dockerinit, volumes, etc).

We change container in the following way:

Container.RootfsPath() returns the the directory which will be used as the root in a running container. It is always of the form "/var/lib/docker/container/<id>/root" and is a private bind mount to the base filesystem. It is only available while the container is running.
    
Container.BasefsPath() returns the raw directory from the graph driver without the container runtime mounts. It is availible whenever the container is mounted (in between a container.Mount()/Unmount() pair, which are properly refcounted).
    
This fixes issue https://github.com/dotcloud/docker/issues/3840