feature: crun-like systemd cgroup driver mode

[kolyshkin]

Runc creates systemd scope (and tries to convert all cgroup-related container settings to systemd unit properties), and on top of that applies all the settings directly to cgroupfs. This method has a few problems:

1. It violates cgroups "single-writer" rule (described here and here).

2. Not all cgroup-related container settings can be converted to systemd unit properties.

3. For those settings that can be converted, such conversion is not always straightforward (examples are cpuset and device access rules).

Unlike runc, crun uses a different approach: it creates a systemd scope with only Delegate=yes property set (i.e. no conversion from container settings to systemd unit properties is performed), then creates a sub-cgroup (aptly named container) under the scope, and then only deals with the sub-cgroup. Essentially, this solves all the problems listed above.

I propose to add an option (runtime flag, build flag etc.) to switch runc systemd cgroup drivers to crun-like mode. In addition to solving the above problems, this will make it easier for upper-level tools to switch between crun and runc.

Obsoletes: #2436