Make error handling uniform across supervisor scripts.

Before this patch, the supervisor scripts had a weird mix of "oh, that service
is already started, I'll just ignore it" and "wait, one of these services is
already stopped, let's freak out". Preconditions were enforced in some areas
more than others.

This patch makes the behavior uniform. If you're operating on a whole package
(read: not supplying a service name on the command line), services that don't
meet a precondition will be skipped over if possible. If you're operating on an
explicit list of services, any precondition violation will cause a fatal error.

Example: I have a package `P` with services `S1`, `S2`, and `S3`. Let's say `S1`
is down, and `S2` and `S3` are both running. In this case, `svc-down P` will do
what you're probably intending: make sure all three of the services end up in
the down state. Conversely, execution of `svc-down P S2 S1` will fail, because
`S1` is already in the down state. Running `svc-down S2 S3` will succeed.

Hopefully this scheme makes sense – scripts can list packages/services
programmatically and target up/down/disable/enable operations surgically,
while humans can concisely say "I just want everything in medic-core to start
running again".
Add /srv/system and move some internal files there.

This commit adds a `/srv/system` directory, which is further subdivided along
the usual lines (e.g. `storage`, `settings`). This directory stores internal
data that's not intended to be modified by users or system administrators.
The plan is to use `/srv/system/settings/packages` to store rewritten
configuration files, and leave the user-modifiable configuration files (now
optionally including template directives) in `/srv/settings`.

This commit also removes many of the hard-coded instances of `/srv`, in hopes of
eventually storing this in a configuration file somewhere, and allowing the
scripts to work in any base directory.