Improve idmap detection/handling

[stgraber]

Currently if the system isn't correctly configured (/etc/subuid and /etc/subgid), it leads to very confusing errors coming from liblxc. This is all data that Incus already parses on startup, so we should be able to perform a check ourselves and give a better error.

On systems where uidmap is in use (newuidmap/newgidmap available), we need to properly handle:

• No map found in /etc/subuid or /etc/subgid
• Insufficient maps found (less than 65536 uid/gid) found
• Map available but doesn't match existing container map (should trigger a shift)
• Map doesn't allow for punch through mapping (should disable it in incus-user)

[stgraber]

Quick update that my massive idmap branch addresses everything except the one before last point, working on that one now.

[stgraber]

Got that one covered now too.