Follow-ups from sharing /run/media etc.

Follow-ups for steamrt/tasks#149.

• pv-bwrap: Pass the provider to pv_bwrap_bind_usr() as a fd

  This reduces the chance of getting the three paths confused: we'll do all I/O relative to the fd, and only use the two paths to form bwrap arguments.

• Add a test for pv_bwrap_bind_usr()

  We use this a lot, so it'll be good to have test coverage.

• pv-wrap: Do filesystem access in pv_wrap_use_host_os() relative to root fd

  This avoids needing to spread the /proc/self/root special case around, and is an enabler for unit-testing this function.

  Making pv_export_root_dirs_like_filesystem_host extern means it'll be easier to test.

• pv-wrap: Add more test coverage for setting up directories

  Now that they act relative to a file descriptor, we can give them a mock root directory to work with.

• pv-wrap: Add test coverage for pv_wrap_use_home in SHARED mode

  This is the most important, and also the most likely to fail, of our three modes. TRANSIENT and FAKE are relatively simple, and are not our default, so they're a lower priority for unit testing.

• pv-wrap: Don't export /overrides even if it exists at top level

  pressure-vessel uses this path internally, for the runtime, so we need to exclude it.