refactor: extract basic container/bridge connection establishment
Note that we do not mark the interface in the container as 'up' here
since some callers, in particular 'attach', add CIDRs to the
interface, and some programs rely on 'up' implying 'has IP address'.