Introduce a tier-0 image

This is basically just:

- kernel
- systemd
- selinux-policy-targeted
- bootc

Notably it doesn't have `rpm-ostree` or `rpm`, or many other things.
It also doesn't even have `linux-firmware`.

And no `openssh`!

It's almost certain that you need to derive from this, but
it should be a suitable starting point.

TODO: Add something like

```
$ dnf-system-bootstrap
Installing packaging tools from quay.io/fedora/fedora-boot-dnf@sha256:abcd...)
 # This would be basically all the packages not in tier-0 that
 # are enough to give `dnf install`
$ dnf install cowsay
 # Install critical stuff
$ dnf system-bootstrap remove
 # Remove everything that we added for the package system, that isn't
 # a dependency of what the user wants!
```

(In theory we could make this work with multi-stage builds, but
 it's a little hard)

tier-1/group

@@ -1,46 +0,0 @@
-root:x:0:
-bin:x:1:
-daemon:x:2:
-sys:x:3:
-adm:x:4:
-tty:x:5:
-disk:x:6:
-lp:x:7:
-mem:x:8:
-kmem:x:9:
-wheel:x:10:
-cdrom:x:11:
-mail:x:12:
-man:x:15:
-sudo:x:16:
-dialout:x:18:
-floppy:x:19:
-games:x:20:
-tape:x:33:
-video:x:39:
-ftp:x:50:
-lock:x:54:
-audio:x:63:
-nobody:x:99:
-users:x:100:
-ssh_keys:x:999:
-systemd-journal:x:190:
-polkitd:x:998:
-etcd:x:997:
-dip:x:40:
-cgred:x:996:
-avahi-autoipd:x:170:
-sssd:x:993:
-dockerroot:x:986:
-rpcuser:x:29:
-nfsnobody:x:65534:
-kube:x:994:
-chrony:x:992:
-tcpdump:x:72:
-ceph:x:167:
-input:x:104:
-systemd-timesync:x:991:
-systemd-network:x:990:
-systemd-resolve:x:989:
-systemd-bus-proxy:x:988:
-cockpit-ws:x:987:

tier-1/group

@@ -0,0 +1 @@
+../tier-0/group