Run qemu as the invoking user again

Run qemu as the invoking user again

This commit also reworks InvokingUser to calculate all its members
on module import (when we haven't yet unshared the user namespace).
become_root() is also changed to modify the InvokingUser object
instead of returning the new uid, gid. Finally, we stop passing
around uid, gid everywhere and just use the InvokingUser object
directly as a singleton.

We also stop dropping privileges in mkosi itself. Instead, we prefer
running ssh, qemu and the embedded web server unprivileged. This
allows us to get rid of the logic to not unmount the last tools tree
as we will now always still have enough privileges to do so.

We also start passing file descriptors to swtpm and virtiofsd to avoid
race conditions where the socket hasn't been created yet before we
pass it to qemu or before we try to chown it.