Container registry client certificates cannot be used with image pull user isolation

The default [user isolation](https://github.com/bootc-dev/bootc/blob/main/crates/ostree-ext/src/container/mod.rs#L444-L452) for container image pulls interacts somewhat poorly with using TLS client certificates to authenticate to registries. It is good practice to restrict read permissions on TLS private keys, so we have systems configured with registry client certificates in `/etc/containers/certs.d/$registry` readable only by root. However, when running `bootc` under systemd (including the default `bootc-fetch-apply-updates.service`), the default user isolation will switch to `nobody` before pulling the container image, which cannot read the client cert and so cannot connect to the registry.

It seems undesirable to open up access to the client key, so for now we've worked around this by unsetting `$INVOCATION_ID` when invoking `bootc` from systemd. Is there a better solution that can be implemented on the `bootc` side?

Start with crates/ostree-ext/src/container/mod.rs at the referenced user-isolation code, then inspect how bootc-fetch-apply-updates.service invokes bootc. Determine how image pulls can access root-only registry client certificates without broadly exposing private keys; done means the documented systemd pull path authenticates successfully while preserving the intended isolation.

Scritto dal modello di indicizzazione a partire dal testo della issue.