Support running inside default docker/podman w/container-selinux

Today the container-selinux policy denies `mount("tmpfs")`. Arguably...this is a bug in the policy with the advent of user namespaces. However, we could just use a temporary directory in an existing tmpfs (or just the container overlayfs which is semantically tmpfs-like). The downside of doing so is that the outer container could see/affect the inner fs, but eh.

For reference today,
```
host$ podman run --security-opt seccomp=unconfined --rm -ti
container$ bwrap --unshare-all --ro-bind / / echo ok
bwrap: Failed to mount tmpfs: Permission denied

host$ sudo setenforce 0
host$ podman run --security-opt seccomp=unconfined --rm -ti
container$ bwrap --unshare-all --ro-bind / / echo ok
ok
```