tmpfiles.d: add entry for /var/lib/containers with 0700 perms to prevent host users from execing suid binaries