frontend for systemd-sysext

Let's add first class support for [systemd-sysext](https://www.freedesktop.org/software/systemd/man/latest/systemd-sysext.html) - but instead of being DDI oriented we fetch and upgrade them from a registry.

Something like:

```
$ bootc sysext -M add quay.io/examplecorp/exampleos-debugtools:latest
```

`-M` here means to automatically run `systemd-sysext merge` after the operation. We'd store the sysexts in `/var/lib/extensions` by default. Other operations:

```
$ bootc sysext rm
$ bootc sysext rm --all
```

These would only remove sysexts that we "own" or write.

Also, `bootc upgrade` by default should error out if a target sysext is incompatible.

---

Original issue:

I think it would make sense to support functionality similarly to https://www.freedesktop.org/software/systemd/man/systemd-sysext.html - we could even use that as a backend, though it needs some design around interactions eventually lowering "live apply" type flows.

A strawman could look like:

```
$ bootc overlay add quay.io/examplecorp/seattle-manufacturing:wifi
```

That would add a new container image that would be *dynamically* unioned with the host's rootfs - on updates, we reapply both - and we'd also verify compatibility and fail if e.g. they appeared somehow incompatible. (A lot of potential things to do in "verify compatibility...")

Start by reading the linked systemd-sysext documentation and the issue's proposed CLI examples. Work out the registry, ownership, merge, removal, and upgrade-compatibility requirements before locating the relevant bootc command structure. Done means the supported sysext operations and upgrade behavior are designed and implemented with validation for incompatible targets.

Written by the indexing model from the issue text.