nspawn: support foreign mappings also when nspawn doing the mapping itself

This adds a new "foreign" value to --private-users-ownership= which is a
lot like "map", but maps from the host's foreign UID range rather than from the
host's 0.

(This has nothing much to do with making unprivileged directory-based
containers work, it's just very handy that we can run privileged
contains with such a mapping too, with an easy switch)

src/shared/mount-util.h

@@ -156,6 +156,9 @@ typedef enum RemountIdmapping {
          * to add inodes to file systems mapped this way should set this flag, but given it comes with
          * certain security implications defaults to off, and requires explicit opt-in. */
         REMOUNT_IDMAPPING_HOST_ROOT,
+        /* Much like REMOUNT_IDMAPPING_HOST_ROOT, but the source mapping is not from 0…65535 but from the
+         * foreign UID range. */
+        REMOUNT_IDMAPPING_FOREIGN_WITH_HOST_ROOT,
         /* Define a mapping from root user within the container to the owner of the bind mounted directory.
          * This ensures no root-owned files will be written in a bind-mounted directory owned by a different
          * user. No other users are mapped. */