container: Add export --format=tar command

[cgwalters]

This adds bootc container export which is designed for compatibility
with the Anaconda "liveimg" verb:
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/automatically_installing_rhel/kickstart-commands-and-options-reference_rhel-installer#liveimg_kickstart-commands-for-installation-program-configuration-and-flow-control

Fixes #1957

Assisted-by: OpenCode (Sonnet 4.5)
Signed-off-by: Colin Walters [email protected]

[gemini-code-assist]

Code Review

This pull request introduces a new bootc container export --format=tar command, a significant feature for creating bootable tar archives from container filesystems. However, the implementation has critical security issues related to symlink handling and metadata preservation. Specifically, the use of symlink-following metadata calls and ambient directory handles could lead to information disclosure of host files if a malicious container image is exported. Additionally, directory metadata is not correctly preserved, resulting in incorrect permissions in the exported archive. Beyond these security concerns, there are also suggestions to improve performance by avoiding unnecessary memory allocations when adding SELinux attributes in container_export.rs and to refactor duplicated code in the kernel relocation logic for better maintainability.