erlxc: provide better errors on failure

erlxc will crash on any errors. Try to provide errors to the caller so
they can diagnose and possibly catch the error and retry the operation.
erlxc_console: revert changes for spawn_executable

Using spawn_executable means shell stderr redirdection is not available.
And since the lxc-console command is still called using bash (by
script), there is not much advantage to bypassing the shell for script.
erlxc: correct path to chroot
erlxc: add an optional timeout
erlxc: support loading config files
erlxc: only run either chroot or create
erlxc: set the root filesystem
erlxc: set utsname
create: allow template to be NULL

liblxc allows the template to be NULL. Nothing happens and create will
return false.
erlxc_drv: add verbose as alias for {verbose,1}
erlxc_exec: execute unprivileged commands

Add a binary to exec a command as another user as an alternative to sudo
and start-stop-daemon.

* sudo expects PAM and configuration to exist

* start-stop-daemon requires the UID/GID to exist in /etc/passwd

erlxc_exec can be run by bind mounting it over another executable inside
the container like /sbin/init. For example, to run an unprivileged shell
listening to a port:

    UID="12345",
    GID="12345",
    Port = "12345",
    erlxc:spawn([
            {chroot, [...]},
            {config, [
                {"lxc.mount.entry", "/sbin sbin none ro,bind,nosuid 0 0"},
                {"lxc.mount.entry",
                "/home/msantos/src/erlang/erlxc/priv/erlxc_exec sbin/init none ro,bind 0 0"},
                ...
            ]},
            {start, [
                {argv, "/sbin/init", UID, GID,
                       "/bin/sh", "-c",
                        "/usr/bin/mkfifo
                        /tmp/shell_fifo;"
                        "/bin/cat
                        /tmp/shell_fifo"
                        "| /bin/bash -i 2>&1"
                        "| /bin/nc -l " ++ Port ++ " > /tmp/shell_fifo"
            ]}
    ]).
erlxc: remove extraneous brackets
erlxc: add support for setting cgroup

The liblxc API for setting cgroups is quirky:

* some items can be set by using set_config_item() by using the lxc
  namespace or by cgroup:

    liblxc:get_config_item(Container, "lxc.cgroup.cpuset.cpus").
    liblxc:get_cgroup_item(Container, "cpuset.cpus").

    liblxc:set_config_item(Container, "lxc.cgroup.cpuset.cpus", "0").
    liblxc:set_cgroup_item(Container, "cpuset.cpus", "0").

* some items can only use *_config_item:

    liblxc:get_config_item(Container, "lxc.cgroup.devices.deny").

* some items can only use *_cgroup_item:

    liblxc:set_cgroup_item(Container, "blkio.weight", "500").
    liblxc:set_group_item(Container, "memory.soft_limit_in_bytes", "268435456").
    liblxc:set_cgroup_item(Container, "memory.limit_in_bytes", "53687091").

The reason for this appears to be:

1. set_config_item/3 is enforced before the container boots

2. get_cgroup_item/2 and set_cgroup_item/3 read/write from the cgroup
directory for the container (usually under /cgroup/lxc/<name>/). These
will fail:

    * if the container is not running
    * the cgroup files do not exist

So these parameters can only be set after booting the container.

3. The cgroup setting "devices.deny" exists but is not
readable/writeable, so has to be set as a configuration value.

Enforcement of cgroups is done after the container is booted. This may
be problematic if, e.g., you want to limit cpu or memory usage the init
script.

cgroup rules are added by by using a tagged tuple to the {config, ...}
property list:

    {config, [
        {cgroup, Key::iolist(), Value::iolist()}
    }]
erlxc: split off cgroups into another tagged tuple

Separate the config and cgroup items.
Remove unused functions returning errno as atom