Run metatron certificate refresh periodically inside containers

This includes:

- Pulling the metatron container code from a docker image, and mounting
  the executable into the user container, similar to how this is done
  for ssh containers
- Metatron systemd service (titus-metatron-sync) and timer for running
  the sync executable every N minutes
- A Netflix-specific endpoint for the executable to query to verify the
  identity of the current task. This data is signed using the agent's
  private Metatron credentials.
- Writing of the task identity struct to
  /var/lib/titus-environments/$cid.id.json to pass it off to the
  metadata service