Add support for measuring an image without writing it to a repo

[allisonkarlitskaya]

In short: cfsctl create-image without a repo. The only thing that this would produce is a fs-verity measurement (of the image) on stdout.

We need:

• a new verb (but this would still requiring opening a repo); or
• some kind of --without-repo mode (but this would break most other verbs)

[allisonkarlitskaya]

The main difficulty here is the selinux relabelling. In order to do that, we need to be able to open the selinux config from the repo in order to query the policy, but we can't do that without the repo because we don't have access to file contents.

We could somehow make an exception and store the necessary selinux files as inlines, or we could figure out a way to (re-)read the selinux config from the source directory directly. Both options are kinda gross.