Use pkg-config to detect libcap.
Define APPJAIL_SWAPDIR constant.

This should be set this to something sane in the future, but remains
at /var/empty for the time being for testing purposes.
Improve tty handling.

We now do the same for the tty as we do for /home: First bind it to a location
which we won't touch, later move it to its destination. This is needed for
refactoring the code to be smarter about umounting and making mounts points
private.
Overhaul umount and propagation handling

1) We now have two arrays shared_directories umount_directories

   The former is a list of prefixes that will not be made private
   but remain slaves of the main system, i.e. mounts will propagate.
   This is empty by default.

   The latter is a list of prefixes that will be unmounted. The default
   contains /dev/shm, /dev/pts, /tmp, /var/tmp and /home since we mount
   our own private versions of those.

   Note that both these options apply to all directories that are
   subdirectories of the given prefix. unmount_directories take
   precedence over shared_directories.

   Right now, the arrays are defined statically. They will be made
   configurable in a future commit.

2) In the beginning, we set the mount propagation to slave.

3) The sanitize_mounts() procedure starts by making / private, unmounting
   /proc with all its submounts and mounting a new /proc.

   It then proceeds to go over all submounts recursively:
   + If the submount matches a prefix in unmount_directories, unmount it
     and its submounts.
   + Unless the submount matches a prefix in shared_directories, make it
     private.
   It ignores APPJAIL_SWAPDIR entirely and never makes anything private
   in there. In particular, if the original system has shared mount
   propagation, the home directory specified with the -H option will
   always get mounts propagated.

   We now iterate over all mount points using libmount and thus don't
   need the MNT_DETACH flag anymore.
unlink or rmdir temporary mount points
Mount our own tmpfs instance instead of using /tmp.

This has the side effect of making the temporary files
invisible to the host, but also takes care of automatic
cleanup on exit.

It also makes appjail without -H truly temporary: No files
will be preserved after exit.