Add job spec option for making / be a bind mount.

[nfachan]

As it currently stands, if you provide a bind mount in the mounts vector with a mount_point of /, things don't go as expected. The problem is that the child process is already sitting on /, so it doesn't see the bind mount. There doesn't seem to be a good way to get it to re-trace the lookup path, since we've already pivot_rooted.

To solve this, we should modify the JobSpec. I'm thinking we can have two types of root. The first is "layers", and the second is "bind". You shouldn't be able to specify both "layers" and "bind" for the root.

We're going to have to do some work to allow the (local) worker to run without a fuse layer fs.

In the meantime, users can piece together bind mounts that cover most of / by individually bind mounting in all of the relevant directories.