rkt run: acquire lock on container directory

stage0 acquires an exclusive advisory lock on the container directory,
leaving the fd open when executing stage1/init with the fd value stored in
the environment variable RKT_LOCK_FD.

stage1's fakesdboot.so shim prevents closure of RKT_LOCK_FD in nspawn by
replacing the close with a O_CLOEXEC fcntl, retaining the lock handle until
nspawn exits.

This facilitates simple and reliable container discovery by external
processes via flock() attempts on container directories.  Consult the
flock(2) and flock(1) man pages for information on advisory file locks.

With this change some basic lifecycle features are trivial using bash:

 Identifying which containers are active:
  shopt -s nullglob
  for c in /var/lib/rkt/containers/*; do
   flock --exclusive --nonblock "$c" echo "$c inactive" || echo "$c active"
  done

 GC of inactive containers:
  shopt -s nullglob
  mkdir -p /var/lib/rkt/gc
  for c in /var/lib/rkt/containers/*; do
   [ -e "$c/stage1" ] || continue
   flock --exclusive --nonblock "$c" mv "$c" /var/lib/rkt/gc
  done

 Assuming a periodic task clears out aged contents from /var/lib/rkt/gc
stage1: record pid of container's init process in $cuuid/pid

Intercept syscall() used by systemd-nspawn for clone, writing the
newly-namespaced child's pid into /var/lib/rkt/containers/$cuuid from the
parent before returning to systemd-nspawn.

This change combined with locking enables simple status queries of running
containers, for example in bash:

 shopt -s nullglob
 for c in /var/lib/rkt/containers/*; do
  [ -e "$c/pid" ] || continue
  flock --exclusive --nonblock "$c" /bin/true || {
   echo $c
   cpid=$(cat "$c/pid")
   nsenter --mount --uts --ipc --pid --root --wd --target "${cpid}" systemctl status
  }
 done
Merge pull request #244 from vcaputo/lock_dir-record_pid

rkt run: acquire lock on container directory and record pid