feat(oci): update and modify every application, and keep its address

- The backup taken before an update or a modification is made on another
  storage when it does not fit on the system disk; an operation without
  room says so before anything is stopped.
- Privileged containers, relaxed AppArmor or seccomp, process limits, the
  host monitors Glances and Netdata and single-file host mounts are
  rebuilt and recovered like any other application.
- HAOS One installs the docker-haos image: port 8123, host time zone,
  unprivileged, watchdog proposed by default; it is updated and modified
  with Home Assistant's own check on the rebuilt container.
- A container that reboots itself gets its DHCP client back.
- The installer takes the address of the container's own interface, and
  the notes of a suite or stack container show its LAN address.
- Seerr installs: its volume belongs to the image user and
  no-new-privileges goes through the include of the container.
- Removing an application deletes its seccomp profile.

oci/catalog/apps/seerr.json

@@ -382,7 +382,10 @@
         "scheme": "http",
         "port": 5055,
         "path": "/api/v1/settings/public",
-        "timeout_seconds": 360
+        "timeout_seconds": 360,
+        "request_timeout_seconds": 5,
+        "verify_tls": false,
+        "stability_seconds": 0
       },
       "security": {
         "options": {
@@ -391,7 +394,20 @@
         }
       },
       "adaptations": [
-        "Compose cap_drop ALL -> lxc.cap.drop reset and lxc.cap.keep none; no-new-privileges -> lxc.no_new_privs 1."
+        "Compose cap_drop ALL -> lxc.cap.drop reset and lxc.cap.keep none; no-new-privileges -> lxc.no_new_privs in the include of the container.",
+        "The configuration volume is given to the user the image runs as, uid 1000."
+      ],
+      "volume_owner": {
+        "uid": 1000,
+        "gid": 1000
+      },
+      "volume_preparations": [
+        {
+          "container_path": "/app/config",
+          "remove_lost_found": true,
+          "owner_strategy": "mapped-application-user",
+          "only_when_mount_type": "managed-volume"
+        }
       ]
     }
   },