Container registry client certificates cannot be used with image pull user isolation

The default [user isolation](https://github.com/bootc-dev/bootc/blob/main/crates/ostree-ext/src/container/mod.rs#L444-L452) for container image pulls interacts somewhat poorly with using TLS client certificates to authenticate to registries. It is good practice to restrict read permissions on TLS private keys, so we have systems configured with registry client certificates in `/etc/containers/certs.d/$registry` readable only by root. However, when running `bootc` under systemd (including the default `bootc-fetch-apply-updates.service`), the default user isolation will switch to `nobody` before pulling the container image, which cannot read the client cert and so cannot connect to the registry.

It seems undesirable to open up access to the client key, so for now we've worked around this by unsetting `$INVOCATION_ID` when invoking `bootc` from systemd. Is there a better solution that can be implemented on the `bootc` side?

Beginne bei crates/ostree-ext/src/container/mod.rs am referenzierten Code zur Benutzerisolierung und untersuche anschließend, wie bootc-fetch-apply-updates.service bootc aufruft. Ermittle, wie Image-Pulls auf nur für root zugängliche Registry-Clientzertifikate zugreifen können, ohne private Schlüssel weitreichend offenzulegen; als erledigt gilt die Aufgabe, wenn der dokumentierte systemd-Pull-Pfad sich erfolgreich authentifiziert und dabei die vorgesehene Isolierung erhalten bleibt.

Vom Indexierungsmodell aus dem Issue-Text verfasst.