core: make DynamicUser=1 and StateDirectory= work with TemporaryFileSystem=/var/lib

core: make DynamicUser=1 and StateDirectory= work with TemporaryFileSystem=/var/lib

The /var/lib/private/foo -> /var/lib/foo symlink for StateDirectory and
DynamicUser is set up on the host filesystem, before the mount namespacing
is brought up. If an empty /var/lib is used, to ensure the service does not
see other services data, the symlink is then not available despite
/var/lib/private being set up as expected.

Make a list of symlinks that need to be set up, and create them after all
the namespaced filesystems have been created, but before any eventual
read-only switch is flipped.