nspawn: Prepare --bind-user= logic for reuse in systemd-vmspawn

Aside from the usual boilerplate of moving the shared logic to shared/,
we also rework the implementation of --bind-user= to be similar to what
we'll do in systemd-vmspawn. Instead of messing with the nspawn container
user namespace, we use idmapped mounts to map the user's home directory on
the host to the mapped uid in the container.

Ideally we'd also use the "userdb.transient" credentials to provision the
user records, but this would only work for booted containers, whereas the
current logic works for non-booted containers as well.

Aside from being similar to how we'll implement --bind-user= in vmspawn,
using idmapped mounts also allows supporting --bind-user= without having to
use --private-users=.

src/basic/forward.h

@@ -291,6 +291,8 @@ typedef struct ImagePolicy ImagePolicy;
 typedef struct InstallInfo InstallInfo;
 typedef struct LookupPaths LookupPaths;
 typedef struct LoopDevice LoopDevice;
+typedef struct MachineBindUserContext MachineBindUserContext;
+typedef struct MachineCredentialContext MachineCredentialContext;
 typedef struct MountOptions MountOptions;
 typedef struct OpenFile OpenFile;
 typedef struct Pkcs11EncryptedKey Pkcs11EncryptedKey;