Support for user namespaces

This exposes UID namespace support.  A new command line option (--uidmap)
maps a set of virtual UIDs to which the application within the container
is confined.  The application could potentially be the root in the
container but unprivileged on the host.

Addresses issue #2918

Docker-DCO-1.1-Signed-off-by: Dinesh Subhraveti <dineshs@altiscale.com> (github: dineshs-altiscale)
Add -x flag to optimize away UID translation

If -x flag is not set, UIDs of the files in the image are assumed to match the specified UID
mappings and no UID translation is performed.

Images with UIDs already translated can be produced by simply committing a container created
with -x flag:

    $ docker commit $(docker run -d -x --uidmap="0:100000:10000" centos true) centos_uid100000
    $ docker run --uidmap="0:100000:10000" -i -t centos_uid100000 bash

Docker-DCO-1.1-Signed-off-by: Dinesh Subhraveti dineshs@altiscale.com (github: dineshs-altiscale)