support drift detection

https://github.com/bootc-dev/bootc/issues/404 is tracking generic factory reset.

However, a subset of the problem domain of factory reset is just visibility into what local state you have.

For `/etc` we have `ostree admin config-diff` which is obscure and tied to ostree.

For `/var` we recently added a `var-tmpfiles` in `bootc container lint` (ref https://github.com/bootc-dev/bootc/pull/1101 ) which is kind of related to this.

I think the CLI here should have some relationship to what we end up doing for factory reset (which is narrowing in on `bootc install` from an existing system).

Maybe then `bootc install --dry-run --print-state` or something could give one this raw information for both `/etc` and `/var` (also note we should do nothing for `/etc` if [transient etc](https://bootc-dev.github.io/bootc/filesystem.html#enabling-transient-etc) is enabled).

However especially for `/var` it's going to be hugely noisy on a lot of systems...e.g. folks probably don't need to be reminded that `/var/log/*` is "state drift" in some sense. Maybe we have a nice way to exclude that stuff (xattr on the dir? something in addition to tmpfiles.d?).

Although with `/var` what we should definitely warn loudly about is files present in the *container's* `/var` that aren't present on disk - typically because someone added new content there in an update and expected it to appear.