libcontainer/userns: simplify, and separate from "user" package.

[thaJeztah]

follow-up to https://github.com/opencontainers/runc/pull/2850 ~(only last commit is new)~ merged

This makes libcontainer/userns self-dependent, largely returning to the original implementation from lxc. The uiMapInUserNS is kept as a separate function for unit-testing and fuzzing.

[kolyshkin]

centos7 failure is a flake; filed https://github.com/opencontainers/runc/issues/2907

CI restarted.

[thaJeztah]

Looks like it passed this time ✅

[thaJeztah]

Ok, rebase fixed that; all ✅ again 😅

[kolyshkin]

LGTM overall, left a single nit about ignoring error from Sscanf (not super important)

[thaJeztah]

@kolyshkin updated per your suggestions, PTAL

[thaJeztah]

rebased to get a fresh run of CI

[kolyshkin]

@thaJeztah this needs another rebase because of a recent regression

[thaJeztah]

👍 rebased to trigger CI again

[thaJeztah]

rebased again; @kolyshkin @AkihiroSuda PTAL

[thaJeztah]

@kolyshkin @AkihiroSuda PTAL

[thaJeztah]

@kolyshkin @lifubang good to go?

[AkihiroSuda]

@thaJeztah Maybe we have discussed before, but maybe we can consider moving this to https://github.com/moby/sys ?

[thaJeztah]

@AkihiroSuda hm.. good one, not sure if we discussed that option. I know containerd has similar code (could've been a fork of this package?)

But now that containerd already depends on moby/sys/user, perhaps it would make sense to move it; if we do, we should probably check if containerd has fixes/changes that we want to integrate (and vice-versa).