feat(oci): update and modify every application, and keep its address

- The backup taken before an update or a modification is made on another
  storage when it does not fit on the system disk; an operation without
  room says so before anything is stopped.
- Privileged containers, relaxed AppArmor or seccomp, process limits, the
  host monitors Glances and Netdata and single-file host mounts are
  rebuilt and recovered like any other application.
- HAOS One installs the docker-haos image: port 8123, host time zone,
  unprivileged, watchdog proposed by default; it is updated and modified
  with Home Assistant's own check on the rebuilt container.
- A container that reboots itself gets its DHCP client back.
- The installer takes the address of the container's own interface, and
  the notes of a suite or stack container show its LAN address.
- Seerr installs: its volume belongs to the image user and
  no-new-privileges goes through the include of the container.
- Removing an application deletes its seccomp profile.

oci/remote/oci_installation_state.py

@@ -195,6 +195,7 @@ def resolve_candidate(reference, architecture):
     # version inside it moved.
     return {'manifest_digest': digest, 'registry_digest': registry_digest,
             'layers': [layer['digest'] for layer in json.loads(raw).get('layers', [])],
+            'size': sum(int(layer.get('size') or 0) for layer in json.loads(raw).get('layers', [])),
             'defaults': defaults, 'version': version, 'created': config.get('created')}