supervisor: Use pivot_root and MS_DETACH to detach from the outside world
Rearrange filesystem layout to use no chroots and a single pivot_root

The supervisor process retains a capability: its current directory
is an isolated bind-mount of the grain directory, despite the fact
that the grain directory is not mounted anywhere.  Only the "sandbox"
subdirectory is mounted.
Fix location of log file

The bug only showed up if --stdio wasn't specified.
Stop requiring that grains contain a 'usr' directory

It turns out that, if you're very careful, you can pivot_root the
old root on top of the new root and then detach it.
In the supervisor process, chroot into a safe directory.
run-bundle: Use pivot_root instead of chroot

If the supervisor runs in a chroot, remounting root MS_REC | MS_PRIVATE will
fail, and user namespaces cannot be used inside a chroot.
supervisor: Add raiiOpen and missing O_CLOEXEC flags
Merge branch 'pivot_root' of git://github.com/amluto/sandstorm

Conflicts:
	src/sandstorm/supervisor-main.c++
Style tweaks after merging Andy's pivot_root stuff.