Add --user/--group to run as a different uid/gid as root

bwrap --uid/--gid require --unshare-user, which is never requested
when running as root (since last session's fix), and user namespaces
aren't a near-term option anyway -- the actual Android target doesn't
support them.

--user <name-or-uid> / --group <name-or-gid> work around this:
user_spec.cpp resolves them against the *mounted image's own*
/etc/passwd and /etc/group (names like "git" only mean anything inside
that image's user database), and bwrap.cpp bind-mounts a small helper
into the sandbox to do the actual privilege drop before exec'ing the
real command, since bwrap itself can't switch uid/gid without a user
namespace.

The helper has to be a separate, statically-linked binary
(priv_drop_helper.cpp -> slocker-lite-priv-drop, built with -static)
rather than slocker_lite's own binary: bind-mounting a dynamically
linked executable into an arbitrary container image fails ("error
while loading shared libraries") since that image's own /lib won't
have slocker_lite's dependencies. find_priv_drop_helper() locates it
next to slocker_lite's own binary; run_bwrap() fails fast if it's
missing rather than silently running as root.

Only works without a user namespace (root): under --unshare-user the
sandbox's uid map has only one valid entry, so the helper's own
setuid() fails cleanly there instead of doing nothing silently.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

meson.build

@@ -18,11 +18,19 @@ configure_file(output : 'config.h', configuration : conf_data)
 
 slocker_lite = executable('slocker_lite',
     ['src/main.cpp', 'src/process.cpp', 'src/oci_image.cpp', 'src/containers_storage.cpp',
-     'src/bwrap.cpp'],
+     'src/bwrap.cpp', 'src/user_spec.cpp'],
     include_directories : include_directories('.'),
     dependencies : [fmt_dep, catch2_dep, yaml_dep, archive_dep, json_dep, spdlog_dep],
     install : true)
 
+# Bind-mounted into the sandbox by -r/--run's --user/--group handling (src/bwrap.cpp),
+# so it must be dependency-free and statically linked to run regardless of what
+# libc/libraries the container image itself has.
+priv_drop_helper = executable('slocker-lite-priv-drop',
+    ['src/priv_drop_helper.cpp'],
+    link_args : ['-static'],
+    install : true)
+
 fixture_tar = custom_target('oci-fixture',
     output : 'fixture.tar',
     command : [find_program('python3'), files('tests/gen_fixture.py'), '@OUTPUT@'])