feat(oci): update and modify every application, and keep its address

- The backup taken before an update or a modification is made on another
  storage when it does not fit on the system disk; an operation without
  room says so before anything is stopped.
- Privileged containers, relaxed AppArmor or seccomp, process limits, the
  host monitors Glances and Netdata and single-file host mounts are
  rebuilt and recovered like any other application.
- HAOS One installs the docker-haos image: port 8123, host time zone,
  unprivileged, watchdog proposed by default; it is updated and modified
  with Home Assistant's own check on the rebuilt container.
- A container that reboots itself gets its DHCP client back.
- The installer takes the address of the container's own interface, and
  the notes of a suite or stack container show its LAN address.
- Seerr installs: its volume belongs to the image user and
  no-new-privileges goes through the include of the container.
- Removing an application deletes its seccomp profile.

oci/remote/oci_host_mounts.py

@@ -34,9 +34,13 @@ def snapshot(source, allow_missing=False):
             'mode': stat.S_IMODE(info.st_mode)}
 
 
-def validate_source(source, allow_missing=False):
+def validate_source(source, allow_missing=False, declared=False):
+    """`declared` is a source the recipe of the application names itself, as a
+    host monitor does with /proc and /sys: it is not one the user typed."""
     valid_path(source)
     value = snapshot(source, allow_missing)
+    if declared:
+        return dict(value, declared=True)
     protected = ('/etc', '/usr', '/bin', '/sbin', '/lib', '/lib64', '/dev', '/proc', '/sys', '/run')
     protected += tuple(str(Path(p).resolve()) for p in protected)
     resolved = value['resolved_path']
@@ -52,7 +56,8 @@ def same_source(a, b):
 
 def verify_sources(expected):
     for source, previous in expected.items():
-        current = validate_source(source, allow_missing=not previous['exists'])
+        current = validate_source(source, allow_missing=not previous['exists'],
+                                  declared=previous.get('declared', False))
         if not same_source(previous, current):
             raise ValueError(f"{translate('The operation was stopped because a shared directory changed its identity:')} {source}")