infrastructure work to add and remove marks on vfsmounts.  This should get
every set up except wiring the functions to the syscalls.
Signed-off-by: Eric Paris <eparis@redhat.com>