nspawn: support foreign mappings also when nspawn doing the mapping itself

nspawn: support foreign mappings also when nspawn doing the mapping itself

This adds a new "foreign" value to --private-users-ownership= which is a
lot like "map", but maps from the host's foreign UID range rather than from the
host's 0.

(This has nothing much to do with making unprivileged directory-based
containers work, it's just very handy that we can run privileged
contains with such a mapping too, with an easy switch)