feat: rootless su for pebble

[hpidcock]

Pebble service layers can specify user/user-id and group/group-id to
run a service as a different Linux user. Today, switching user requires Pebble
itself to be running as root (UID 0): the service is started with
setresuid(2)/setresgid(2) applied between fork(2) and execve(2),
and the kernel only honours those calls for privileged callers.

Pebble is often run as a non-root user inside a container (security best
practice; rootless Podman / Kubernetes runAsNonRoot), but the workload
still needs to drop further to a different unprivileged uid (e.g. nobody,
an app-specific user).

yuzu is a prototype privilege-delegation tool built to handle
exactly this Pebble use case. It is a setuid-per-profile helper that lets an unprivileged
Pebble process exec a command as another user, with authorisation governed by a config
file written at image-build time rather than by host-level privilege.

This spec proposes that, when Pebble is not running as root and the yuzu
binary is available on PATH, Pebble starts services that request a user
or group switch by exec'ing them through yuzu instead of calling
setresuid/setresgid directly.