Sealed image build UX + implementation

(Spawned from [composefs-rs integration tracker](https://github.com/bootc-dev/bootc/issues/1190))
(See also: https://github.com/containers/composefs-rs/pull/143)

The repo for composefs-rs has [many examples](https://github.com/containers/composefs-rs/tree/main/examples) that sketch out proof-of-concept image builds. However, I think we need to improve on the user experience of building sealed images. It's gotta be something better than "copy and paste these example Containerfiles". So here's the place where we'll debate and design how this might work "for real".

My initial thought is to follow the prior art of the rechunker. Currently that's made up of a few parts:

- `bootc-base-imagectl rechunk` at the top-level, which ultimately calls...
- `rpm-ostree compose build-chunked-oci`

And then rechunk just takes `--from` and `--to` imgrefs and does the conversion automatically between the original and rechunked format. Ideally we should have a similar workflow for building sealed images:

- `bootc-base-imagectl seal --from quay.io/example/my-img:unsealed --to quay.io/example/my-img:sealed` that calls some new code like...
- `bootc internals build-sealed-image` (naming very bikesheddable)

And as a related note (this will eventually be spun-off into its own sub-issue) we'll need to expand `bootc container lint` to be able to lint sealed images.