netowrkd:deserialize_dhcp_routes verify strndup ret

strndup need to be chcked
network-internal: initialize _cleanup_ variable
man: document the sysusers tool
util: refuse considering UID 0xFFFF and 0xFFFFFFFF valid
sysusers: split up default sysusers snippet

This ways, distributions have an easier way to replace the OS specific
generic groups/users while keeping systemd's own.
tests: add missing XDG_RUNTIME_DIR env variable

Otherwise the test fails because specifier_runtime() returns -ENOTSUP
when XDG_RUNTIME_DIR is not set.
util: fix comment
networkd: dhcp - use same metric for all DHCP-related routes
units: networkd - don't order wait-online.service before network.target

Reported by Michael Olbrich.
shared/util.c:wait_for_terminate_and_warn(): Add a comment on the return values
nspawn: Fix regression with exit status

Commit 113cea8 introduced a bug that caused the exit code of systemd-nspawn
to not reflect the exit code of the program executed in the container.
nspawn: log a warning on failure from wait_for_terminate()

This is at the suggestion of Djalal Harouni on the mailing list, and
reflects the behavior of shared/util.c:wait_for_terminate_and_warn().
nspawn: simplify exit condition check
nspawn: let's avoid using goto to wildly for non-cleanup purposes
nspawn: block open_by_handle_at() and others via seccomp

Let's protect ourselves against the recently reported docker security
issue. Our man page makes clear that we do not make any security
promises anyway, but well, this one is easy to mitigate, so let's do it.
While we are at it block a couple of more syscalls that are no good in
containers, too.
man: add a minimized, modernized description of the file system hierarchy systemd suggests
man: drop references to manual StandardError=syslog from daemon(7), we do this implicitly since ages
tmpfiles: don't do automatic cleanup in $XDG_RUNTIME_DIR

Now that logind will clean up all IPC resources of a user we should
really consider $XDG_RUNTIME_DIR as just another kind of IPC with the
same life-cycle logic as the other IPC resources. This should be safe
now to do since every user gets his own $XDG_RUNTIME_DIR tmpfs instance
with a fixed size limit, so that flooding of it will more effectively be
averted.
man: a couple of additions to file-hierarchy(7)
tmpfiles: explicitly set mode for /run/log