Fix help output for "rpm-ostree compose"

"rpm-ostree compose {tree,sign} --help" acted as if no subcommand was
given.  But the compose subcommands each have a good number of options
so it's particularly important to list them.
ostree-nspawn: Obsolete, delete

It's useful as a demo, but doesn't need to live here.
util: Add helper function to set GError from errno

Really this should be in libgsystem (or possibly glib-unix.h), we have
a copy in ostree.  But we can refactor to use a shared version later.
compose: Refactor sync waitpid into helper

Will be used for a future commit.
cleanup: Add a _cleanup_close_

Matching systemd.
util: Move _rpmostree_perror_fatal here

Will be used in other places in later commits.
compose: Introduce a little 'libcontainer', use it for the post script

The current motivation for this is that

https://github.com/fedora-infra/fedmsg-atomic-composer

started using mock --new-chroot (which uses systemd-nspawn) to run
rpm-ostree, which in turn uses systemd-nspawn to run the post script.
Now systemd-nspawn is not really nestable (it wants to link up
journald, resolv.conf handling, etc).

First, dropping nspawn and going to raw containers fixes the nesting
problem.

Second, we don't need all the features of systemd-nspawn.  We are ok
with log messages going to stdout, and we don't use networking, so no
resolv.conf is needed.

Third, this sets a bit of a stage for more sandboxing internally when
run on real systems.  I already have a prototype branch which runs
librepo as an unprivileged user, that could be combined with this for
even stronger security.

Why not use systemd?  Well...I'm still debating that.  But the core
problem is systemd isn't a library in the C sense - to use its
sandboxing features we have to use unit files.  It's harder to have a
daemon that looks like a single service from a management perspective,
but uses sandboxing internally.
postprocess: Use run_sync_in_root() for other subprocesses

Let's use these new libcontainer bits instead of invoking chroot().
It's stronger security.
postprocess: Make use of _prefix_error for format printing

Followup from https://github.com/projectatomic/rpm-ostree/pull/55
Release 2014.112
docs: Update sample treefile example and add example repo file
libcontainer: Fix inverted logic

=/

Originally it was "container_disabled" but the double negatives
started being awkward, I missed converting this negation.

This should really make us work again on RHEL6.
Release 2014.113
compose: Add --check-passwd/group options, fails compose if uids/gids change