Add option to confirm ownership before shifting

The allows the script to only shift ownership if a filesystem
appears to be unshifted. If all of the files of a given filesystem
are owned by uid and gids in the shifted range, it is assumed
that the filesystem has already been shifted and the script exits.
Bit of a nit, why not combine --exit-on-fail and assume that if you use --confirm, you're wanting to fail if it doesn't pass the confirmation?