Add support for `bootc install --with-overlay quay.io/exampleuser/someoverlay:latest`

I've been advocating general [configmap and secret](https://github.com/containers/bootc/issues/22) support for a while.

However, the way CoreOS does things today with Ignition is basically allowing the admin to inject "day 1 unmanaged state" that is decoupled from the image/host. And actually, that's how [Anaconda kickstart](https://anaconda-installer.readthedocs.io/en/latest/kickstart.html) works too.

There's a lot of advantages to configmap-in-registry around supporting "day 2" changes too. However, it will require workflow and tooling changes to adapt.

One key thing I'm narrowing in on is the basic use case of "inject a ssh key into an existing golden image" - a thing I think we really want to support. And we *do* today via e.g. Anaconda or other installers.

But I think we should support this more natively via `bootc install` too.

So here's my strawman: the `--with-overlay` argument takes a container image reference and operates only at install time. A very key difference from the configmap approach is that the image *must* drop files into `/etc` and `/var`. This gives us immediate, direct support for SSH keys by injecting e.g. `/var/roothome/.ssh/authorized_keys`.

## Migrating from Ignition

But actually the neat thing with this is it provides a very seamless adaptation of existing Ignition configuration! We've already prototyped out support for extracting an Ignition configuration to its set of files via `ignition-apply`, so it'd literally look like:

```
FROM quay.io/coreos/butane:release as builder
COPY foo.ign foo.ign
RUN ignition-apply --root /config foo.ign # render ignition to filesystem tree, error on partitioning

FROM scratch
COPY --from=builder /config /
```

Then push that to a registry as `quay.io/exampleuser/someoverlay:latest`, and one can do `bootc install --with-overlay quay.io/exampleuser/someoverlay:latest` and then one can switch to installing via bootc *without* needing to change all the bits in the Ignition config to move to `/usr` content etc.

So any tools (e.g. OpenShift MCO) that act on "day 2" management for this "unmanaged state" can seamlessly continue to work - but we avoid the need to e.g. host Ignition servers.

Start at the bootc install command and review the linked configmap and secret issue plus the described ignition-apply workflow. Define how an install-time --with-overlay image is handled, including the restriction to /etc and /var, and determine the tests needed to show overlay files such as SSH authorized_keys are installed correctly.

Scritto dal modello di indicizzazione a partire dal testo della issue.