dynamic overlays

This overlaps with https://github.com/containers/bootc/issues/7 some.

Here, the basic idea is something like:

```
bootc config add [--root=/etc] examplecorp.com/config:latest
```

Where `config.yml` is a standard [Kubernetes ConfigMap](https://kubernetes.io/docs/concepts/configuration/configmap/). By default, we "mount" the keys to `/etc`. Then, `bootc upgrade` looks for updates to all provided configmaps - if any change, it triggers the same upgrade logic as the base image.

We also fetch and handle secret objects in the same way. It'd be cool though to support something like handling encrypted secrets (and configmaps) which need to be decrypted via a key (which could be in a TPM or so).

We also need to think carefully about file permissions; mode 0644 for all configmap files and 0600 for secrets may make sense. In addition we could support special annotations to override these.

(This should also work to be invoked immediately after `bootc install` to have it ready on the first boot, i.e. we also have a `--root` argument or so)

The issue names no files or tests; start by locating the command entry points for bootc config add, bootc install, and bootc upgrade. Define the scope for ConfigMap and secret retrieval, mounting under --root, update-triggered upgrades, permissions, and first-boot handling before implementation.

Vom Indexierungsmodell aus dem Issue-Text verfasst.