container commit: Handle sysusers and/or nss-altfiles

[cgwalters]

OK, trying to migrate my systems to container-native I got bit by the lack of altfiles handling (libvirt wants a qemu user).

We should migrate the logic for altfiles handling from rpm-ostree into ostree container commit.

I think starting now, we should default to injecting sysusers.d fragments and not doing altfiles. But this is open to debate.