IMPORTANT NOTE: Previously, rpm-ostree tried to use container features itself
when executing postprocessing scripts, `dracut` etc.  However, if rpm-ostree
itself was inside a container (Docker, mock, etc.) and setting up a recursive
container failed, we would silently fall back to not containerizing.

This release undoes that fallback, because in order to do things correctly and
safely in the future, we really need the ability to containerize.

With this release, rpm-ostree no longer has its own internal container
code - we use [bwrap](https://github.com/projectatomic/bubblewrap).

Notably, this a regression from 2016.6 where we actually broke the *non-containerized*
case, because most of our tests have been running inside Docker.

Now if you want to use rpm-ostree inside Docker, you need to start
with `--privileged`, or alternatively enable user namespaces.

Git-EVTag-v0-SHA512: c6325765e0322a1ec4b40ffc2ea4fda7a52a61ad58d66d1c883ac42fbafc9bb838dc94e2022b8d12bddd9dd0a8899f3bee34d852dcc4749bb826839b8feea602