feat(oci): update and modify every application, and keep its address

- The backup taken before an update or a modification is made on another
  storage when it does not fit on the system disk; an operation without
  room says so before anything is stopped.
- Privileged containers, relaxed AppArmor or seccomp, process limits, the
  host monitors Glances and Netdata and single-file host mounts are
  rebuilt and recovered like any other application.
- HAOS One installs the docker-haos image: port 8123, host time zone,
  unprivileged, watchdog proposed by default; it is updated and modified
  with Home Assistant's own check on the rebuilt container.
- A container that reboots itself gets its DHCP client back.
- The installer takes the address of the container's own interface, and
  the notes of a suite or stack container show its LAN address.
- Seerr installs: its volume belongs to the image user and
  no-new-privileges goes through the include of the container.
- Removing an application deletes its seccomp profile.

oci/remote/oci_console_mark.sh

@@ -1,9 +1,14 @@
 #!/bin/sh
-# Marks each start of an OCI container in its console log, so the log can be
-# read from the last start. Run by the container's lxc.hook.pre-start.
+# Run by the lxc.hook.pre-start of an OCI container. Marks each start in its
+# console log, so the log can be read from the last start, and queues the
+# check of its DHCP address for when it is up.
 case "$1" in
   ''|*[!0-9]*) exit 0 ;;
 esac
 printf '\n=== ProxMenux: container started %s ===\n' "$(date '+%Y-%m-%d %H:%M:%S')" \
   >> "/var/log/proxmenux/oci/$1.console.log" 2>/dev/null
+lease="${0%/*}/oci_dhcp_lease.py"
+if [ -r "$lease" ] && command -v systemd-run >/dev/null 2>&1; then
+  systemd-run --quiet --collect --on-active=20 /usr/bin/python3 "$lease" "$1" >/dev/null 2>&1
+fi
 exit 0