Protect Users from themselves WRT ContainerEntryPoint

it'll be important to document that the Entrypoint needs to be a fully-rooted path. I could see users doing something like

```xml
$(AppName)
```
and attempting to package up an executable at what is effectively `/$(AppName)`, which won't exist.

Maybe there's some validation we can do here to save them: either checking that a fully-rooted path was provided, or attempting to 'root' a relative or un-rooted path against the `ContainerWorkingDirectory`.

_Originally posted by @baronfel in https://github.com/rainersigwald/containers/pull/38#discussion_r923867246_

Start with the ContainerEntrypoint and ContainerWorkingDirectory behavior described in the issue, then read the referenced discussion in pull request 38. Confirm whether the intended outcome is documentation, validation, or path handling, and consider the work done when the selected behavior is clearly documented or specified.

Written by the indexing model from the issue text.