Remove access to the output directory in build scripts

Remove access to the output directory in build scripts

With mkosi -t none, we can rerun the build script without cleaning
the output directory. This creates an awkward situation, as the build
script might create new outputs but is unable to remove previous ones,
which could lead to weird situations where the output directory contains
artifacts from multiple builds.

Let's tighten this up by disallowing access to the output directory in
build scripts. Users can still copy from the build script to the output
directory by doing the copy from a post-installation script which is not
invoked when we run mkosi -t none so it only runs when we've cleaned up
the output directory.