Compose time privilege separation

[cgwalters]

See https://bugzilla.gnome.org/show_bug.cgi?id=738954

We can do this better by splitting up the "create installroot" and "commit" parts of treecompose. The "commit" portion only needs privileges to write to the target repo.

I think the easiest path here would be (if --commit-as-repo-owner or so is specified)

• Detect owner/group of target repo
• Call a separate binary /usr/libexec/rpm-ostree/commit after set{g,u}id()

I looked briefly at doing the setuid() inside the main compose binary just before commit but there's a wrinkle - we need to be able to clean up our temporary data. In general when doing privilege separation stuff we really want to have clearly defined roles and input/output for each process.

[mbarnes]

FWIW, a separate setuid/gid binary strikes me as the right way -- I've used that trick myself in the past. But shouldn't committing as repo owner be the default behavior? I wouldn't expect it to require an explicit switch.

[cgwalters]

Obsoleting in favor of #729