Add support for rpm-ostree deploy --ex-cliwrap=true

This is a better alternative to coreos/fedora-coreos-config#830

Basically rather than trying to send this out to all FCOS users,
it's much saner to allow people to opt-in to it locally.

If we'd finished coreos#2326
then this would be something as trivial as:
```
$ echo 'cliwrap: true' > /etc/rpm-ostree.d/cliwrap.yaml
$ rpm-ostree rebuild
```

Unfortunately that's not the world we live in, so a whole lot of
layers here need crossing to just propagate a boolean.  And it
interacts in a tricky way with our change detection code.

But, it works and will allow people to try this out.

Other fixed problems:

- Our `rpm --verify` wrapping was broken
- Dropping privileges clashed with the default directory being `/root`,
  so `chdir(/)` too

src/daemon/rpmostree-sysroot-upgrader.cxx

@@ -87,6 +87,7 @@ struct RpmOstreeSysrootUpgrader {
 
   gboolean layering_initialized; /* Whether layering_type is known */
   RpmOstreeSysrootUpgraderLayeringType layering_type;
+  gboolean cal_assembly; /* True if the txn knows that something changed, e.g. cliwrap */
   gboolean layering_changed; /* Whether changes to layering should result in a new commit */
   gboolean pkgs_imported; /* Whether pkgs to be layered have been downloaded & imported */
   char *base_revision; /* Non-layered replicated commit */