Fix unprivileged containers started by root

This change makes it possible to create unprivileged containers as root.
They will be stored in the usual system wide location, use the usual
system wide cache but will be running using a uid/gid map.

To make things consistent as well as avoid potential range conflicts,
I'm removing the code that was directly writing the uid/gid ranges and
instead force all unprivileged containers through newuidmap/newgidmap.
This means you need to grant uid/gid ranges to root just as you would
for a normal user.

bdev and network restrictions however don't apply to those containers,
so you don't need to add lxc-usernic entries for root.

This essentially requires anyone wanting to run unprivileged containers
to have newuidmap and newgidmap on their system, those two are provided
by a very recent version of shadow.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>