Design for composefs+containers integration

[cgwalters]

So far, to the best of my knowledge we have basically demoed https://github.com/containers/storage/ composefs and ostree composefs integration.

However, we need to really flesh out the standardized support for building signed container images that cover the composefs metadata, and ensure that e.g. c/storage supports verifying the signature before mounting, etc. There's quite some details here.