feature: crun-like systemd cgroup driver mode

Runc creates systemd scope (and tries to convert all cgroup-related container settings to systemd unit properties), and on top of that applies all the settings directly to cgroupfs. This method has a few problems:

1. It violates cgroups "single-writer" rule (described here and here).

2. Not all cgroup-related container settings can be converted to systemd unit properties.

3. For those settings that can be converted, such conversion is not always straightforward (examples are cpuset and device access rules).

Unlike runc, crun uses a different approach: it creates a systemd scope with only Delegate=yes property set (i.e. no conversion from container settings to systemd unit properties is performed), then creates a sub-cgroup (aptly named container) under the scope, and then only deals with the sub-cgroup. Essentially, this solves all the problems listed above.

I propose to add an option (runtime flag, build flag etc.) to switch runc systemd cgroup drivers to crun-like mode. In addition to solving the above problems, this will make it easier for upper-level tools to switch between crun and runc.

Obsoletes: #2436

No files or tests are named. Start by locating runc's existing systemd cgroup driver and comparing its behavior with the crun approach described here; done means an option selects the mode and the resulting scope and container sub-cgroup avoid converting settings into systemd properties.