Adding policy enforcement for User.

[matajoh]

This PR adds policy enforcement for the User property of container processes. Policy authors can now explicitly allow and deny users, groups, and umasks associated with the init process and exec processes that they define on containers.

[helsaawy]

Comments below, but in tandem, does GetUserInfo actually need to be exposed? Its doesnt do anything for Open/ClosedDoorSecurityPolicyEnforcer, and its returns are only ever passed to (SecurityPolicyEnforcer) EnforceCreateContainerPolicy and (SecurityPolicyEnforcer) EnforceExecInContainerPolicy, so the userinfo retrieval logic could probably be hidden in those two functions, without needing to change the function signatures

[matajoh]

So @helsaawy the current design change was made to avoid the cost of checking the password and group files when the data is not needed, i.e. with Standard and OpenDoor policies. However, if as you say we collapse the functionality into the different methods (EnforceCreateContainerPolicy and EnforceExecInContainerPolicy) then we have a situation where those methods become considerably more difficult to test, as we would have to mock the file system calls to read the passwd and group files. Having it this way is a compromise that avoids that.

[anmaxvl]

lgtm