core: split out cgroup specific state fields from Unit → CGroupRuntime

This refactors the Unit structure a bit: all cgroup-related state fields
are moved to a new structure CGroupRuntime, which is only allocated as
we realize a cgroup.

This is both a nice cleanup and should make unit structures considerably
smaller that have no cgroup associated, because never realized or
because they belong to a unit type that doesn#t have cgroups anyway.

This makes things nicely symmetric:

        ExecContext → static user configuration about execution
        ExecRuntime → dynamic user state of execution
        CGroupContext → static user configuration about cgroups
        CGroupRuntime → dynamic user state of cgroups

And each time the XyzContext is part of the unit type structures such as
Service or Slice that need it, but the runtime object is only allocated
when a unit is started.

src/test/test-bpf-firewall.c

@@ -155,10 +155,11 @@ int main(int argc, char *argv[]) {
                 return log_tests_skipped("Kernel doesn't support the necessary bpf bits (masked out via seccomp?)");
         assert_se(r >= 0);
 
-        assert_se(u->ip_bpf_ingress);
-        assert_se(u->ip_bpf_egress);
+        CGroupRuntime *crt = ASSERT_PTR(unit_get_cgroup_runtime(u));
+        assert_se(crt->ip_bpf_ingress);
+        assert_se(crt->ip_bpf_egress);
 
-        r = bpf_program_load_kernel(u->ip_bpf_ingress, log_buf, ELEMENTSOF(log_buf));
+        r = bpf_program_load_kernel(crt->ip_bpf_ingress, log_buf, ELEMENTSOF(log_buf));
 
         log_notice("log:");
         log_notice("-------");
@@ -167,7 +168,7 @@ int main(int argc, char *argv[]) {
 
         assert_se(r >= 0);
 
-        r = bpf_program_load_kernel(u->ip_bpf_egress, log_buf, ELEMENTSOF(log_buf));
+        r = bpf_program_load_kernel(crt->ip_bpf_egress, log_buf, ELEMENTSOF(log_buf));
 
         log_notice("log:");
         log_notice("-------");