Add transaction support to API

[tjkirch]

These commits add transaction support to the API. The goal is allowing our services to commit their change sets without interfering with each other or with any user changes.

The API surface shifts slightly:

• /settings/pending becomes /tx to show a requested transaction
• The methods under /settings (commit, apply, commit_and_apply) move under /tx
• Several methods have a new ?tx= parameter to specify the transaction, defaulting to "default" (which allows users to not think about this)
• /tx/list is added to list transaction names

How it works:

• The data store adds a level of directories under pending, each of which is a named transaction, e.g. "default".
  • Those directory names are encoded the same way keys are, so we don't have to care overmuch about the name format.
• The startup services (moondog, sundog, etc.) use a shared "thar-boot" transaction.

Other notes for reviewers:

• It might help to review the commits in order rather than the whole set. It looks long, but really it's a few simple changes repeated.
• sundog had a loop in get_populated_settings, where it checks what's already set so as not to overwrite it, that would look at pending and committed settings. We no longer need to check pending settings because we run settings-committer as a pre-exec command for sundog. It's not strictly related to this PR, but that whole block changed for other reasons.
• Committed::Pending was updated to store the relevant transaction name. It's a String because the alternatives I tried were worse. This means Committed can no longer be Copy, which is why there are so many changes just adding a & to a Committed - we almost never need ownership anyway.
• The pending data store directory structure changed to add the transaction level, but storewolf always removes the pending directory on boot, so we shouldn't have to worry about migrations from/to the prior layout.

Further work for separate PRs:

• We need to update the control container to include the enable-admin-container improvement - @etungsten said he could hold his version bump to include this too.
• netdog can now use the API system (templates, etc.) instead of reinventing the wheel.

Testing done:

Existing and updated unit tests pass.

An AMI was still happy, pods ran, etc.

Further manual testing: I played around with transactions against the new API server. I had parallel transactions, confirmed that one would apply correctly and then another. I confirmed I could list and delete them. (It's an awful lot of output to put in a PR, and the output is identical to before; the only new API is /tx/list which returns a simple JSON list like ["tx1","tx2"].)

[etungsten]

💸

[zmrow]

📻

[tjkirch]

This push addresses concerns from @etungsten and @zmrow; thanks!

[tjkirch]

This change puts the control container change in its own commit, per @bcressey.