Fix #492: add per-service directories, systemd RuntimeDirectory style

A service that drops privileges cannot create its own PID file in
/run, root owns it.  Finit can create the file with pidfile-create,
but the daemon still cannot touch it to confirm a SIGHUP.

Five new settings, block format only: runtime-dir, state-dir,
cache-dir, logs-dir, and config-dir.  The value is a directory name,
resolved under /run, /var/lib, /var/cache, /var/log, and /etc,
respectively.  The directory is created before the service starts,
mode 0755 owned by user/group, and the full path is exported to the
process as RUNTIME_DIRECTORY, STATE_DIRECTORY, CACHE_DIRECTORY,
LOGS_DIRECTORY, and CONFIGURATION_DIRECTORY.  Mode and ownership are
asserted at creation only, a daemon may tighten them afterwards.

The runtime directory is removed when the unit stops, after any
exec-stop-post script, like systemd with RuntimeDirectoryPreserve=no.
A completed run/task counts as stopped unless remain-after-exit keeps
it up.  The other four persist across restarts.

These are the first settings with no legacy token: they are validated
by service_set_dir() and stored on the svc that service_register()
now returns.  systemd accepts a list of directories per setting; this
is a single name for now, widening later is compatible since
libconfuse accepts a bare value for a list option.

The test sysroot gains libnss_files.so.2, which ldd cannot see, glibc
dlopen()s it.  Without it getpwnam() fails inside the chroot, so
user/group settings never resolved and directory ownership could not
be tested.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

doc/config/service-opts.md

@@ -96,6 +96,45 @@ following settings are available:
   * `oncrash = "script"` -- similarly, but instead of rebooting, call
     the `exec-stop-post` script with exit code `crashed`, see below
 
+Service directories
+-------------------
+
+Five settings ask Finit to create a directory for the service before it
+starts, owned by its `user` and `group`, mode 0755.  The value is a
+directory name, resolved under a fixed base -- absolute paths and `..`
+are refused:
+
+| Setting | Base | Environment variable |
+|---|---|---|
+| `runtime-dir` | `/run` | `RUNTIME_DIRECTORY` |
+| `state-dir` | `/var/lib` | `STATE_DIRECTORY` |
+| `cache-dir` | `/var/cache` | `CACHE_DIRECTORY` |
+| `logs-dir` | `/var/log` | `LOGS_DIRECTORY` |
+| `config-dir` | `/etc` | `CONFIGURATION_DIRECTORY` |
+
+Each resolved path is exported to the process environment under the
+listed name, the same names systemd uses for `RuntimeDirectory=` and
+friends.
+
+The runtime directory is removed again when the service stops, after
+any `exec-stop-post` script has run; `/run` is a tmpfs so it would not
+survive a reboot anyway.  The other four persist.  A completed `run` or
+`task` counts as stopped, unless `remain-after-exit` keeps it alive
+until stopped for real.
+
+This is what lets a service drop privileges and still create, and
+later touch, its own PID file:
+
+    service ntpd {
+        user        = "ntp"
+        group       = "ntp"
+        runtime-dir = "ntpd"
+        pidfile     = "/run/ntpd/ntpd.pid"
+        command     = "/usr/sbin/ntpd -n -p /run/ntpd/ntpd.pid"
+    }
+
+These settings exist only in the block format.
+
 Stopping and reloading
 ----------------------