compose: Protect the system during treecompose using container APIs

I was looking again at using hawkey/librepo, and realized just how
much I'd have to fight all of these libraries to avoid affecting
the running system.

What we really want to do with librepo/hawkey is run them effectively
unprivileged, and to hide the system's RPM database from them.  This
is a baby step towards that, by confining our existing yum.

- /usr, /etc, and /var/lib/rpm are mounted read-only
- yum is now run under CLONE_NEWPID, to avoid stray %post scripts
  affecting system processes
Cleanup by using libgsystem cleanup functions

For some reason we ended up defining our own macro to define cleanup
functions, when libgsystem has a usable one.  Switch to that, fewer
lines of code, more consistency.
Centralize cleanup function definitions

We might as well do what systemd does and have a big header which
defines all of them, to more conveniently share them for libraries
that don't include them (like hawkey/librepo, as well as things that
libgsystem doesn't yet cover).
Merge pull request #45 from cgwalters/cleanup-cleanup

Looks great.
doc: Restore treefile.md docs
doc/treefile.md: Document remove-files
compose: Rename _postprocess function to _prepare_rootfs_for_commit()

It's a lot clearer what we're doing.  This is preparation for further
work in cleaning up how we do content processing.
compose: Split out JSON helpers into separate file

In preparation for using some of them in the postprocessing code too.

Yeah, parsing JSON in C sucks =( Oh well.
compose: Move content processing code into -postprocess

It seems clearer to me if all code which is operating on the content
(such as enabling systemd units) is under -postprocess.  The "compose
tree" code should be tying everything together and calling out to
sub-components.

This is prep for adding more postprocessing code.
compose: Support 'install-langs'

This should exist for the same reason the yum and RPM options do; some
people want to construct more minimal systems.
compose: Support 'remove-from-packages' entry

This is the equivalent of the 'removefrom' verb in Lorax's templating.
It's a lot more robust than a generic "rm-rf" type thing, because most
often you only want to remove files from particular packages.
compose: Support 'postprocess-script'

This is obviously a total cop-out.  However, without glibc fixes, we
can't do better.  See:

https://bugzilla.redhat.com/show_bug.cgi?id=156477
Release 2014.110
packaging: Update BRs
treecompose: Suppress signal handling borkage from rpm and librepo
Some initial librepo code