infrastructure work to add and remove marks on vfsmounts.  This should get
every set up except wiring the functions to the syscalls.
Signed-off-by: NEric Paris <eparis@redhat.com>