[jmarrero]

bootc disk images with separate filesystems at /var or below (for example
LVM logical volumes for /var, /var/log or /var/home, configured through
customizations.disk) currently boot with those filesystems missing content:

• The image's own /var content is seeded by bootc install to-filesystem
  into the deployment's state directory on the root filesystem, and the
  separately mounted filesystems hide it at boot. The install stage only
  mounts /, /boot and /boot/efi, so bootc never sees the /var
  filesystems.
• Customizations applied after the install (users, home directories, SSH keys,
  files, subscription) are written to the same hidden location: the ostree
  deployment's /var is a non-recursive bind mount of the stateroot var, so the
  /var filesystems mounted on the physical root are not visible to those
  stages. For example, a blueprint user with an SSH key has no home directory or
  authorized_keys at boot when /var/home is a separate volume.

Reported in osbuild/bootc-image-builder#1222.

This PR has two commits:

1. manifest: mount /var filesystems on top of the bootc deployment: the
   post-install stages mount the /var filesystems after the
   org.osbuild.ostree.deployment mount and before the (recursive) bind mount
   to the tree, so customizations land on the filesystems that are mounted at
   boot. Since setfiles does not descend into other mounts, each of them is
   also relabeled explicitly. This works with any bootc version.
2. bootc: pass /var mounts to bootc install when bootc supports them: bootc
   can initialize filesystems mounted below the target's /var from the image
   and advertises this as the initialize-var-mounts install feature in
   bootc container inspect (install: Initialize separately mounted /var filesystems from the image bootc-dev/bootc#2521). The feature is looked
   up in the container that runs the installation (the build container, if one
   is set), and only then are the /var filesystems mounted for the
   install-to-filesystem stage. Otherwise the stage keeps mounting just /,
   /boot and /boot/efi: older bofilesystems
   empty, and versions before 1.12 reject mountpoints in the target root, so
   builds with older bootc behave ex
   bootc container inspect output running it,
   and run once per container.

Layouts without filesystems below `/ts as before.

Testing

• Unit tests for the post-install mo, the install
  stage mounts with and without the om
  bootc container inspect (includi), and the
  build container taking precedence.
• Manifests for the default partition layout are byte-identical to main
  (fixed --seed), both for a bootcand for stock
  bootc 1.16.10.
• End-to-end qcow2 and VMDK builds of a Fedora 44 bootc image with LVM layouts
  (a separate /var with nested LVsparate /var),
  booted under UEFI:
  • With the bootc change: the imaget user's home
    directory and SSH key are on the right volumes, restorecon -n is clean,
    and no units fail.
  • With stock bootc 1.16.10: the install stage gets no /var mounts (as
    before), and the user's home dirn the /var
    volume.

Related: osbuild/bootc-image-builder#1222, bootc-dev/bootc#1615

DRAFT, no need for reviews yet. This is my first pass and I have limited knowledge of image-builder. Need to test this more.
This also depend on bootc-dev/bootc#2521 being polished and accepted.