rechunker: Do cleanup too

[cgwalters]

It'd be quite useful if we scope-creeped the rechunker into general "image cleanup"/analyzer.

Especially I think it'd be nicer to fix things like bootc-dev/bootc#1096 at build time - and we have the power to do that here.

Related to all of this is: Today the rechunking code is kind of carefully written to not mutate the input root filesystem. It'd actually be way less awkward if we did do that, because then we could e.g. blow away /sysroot etc instead of just trying to avoid committing it.

I think the reason I may have written things this way is I thought that RUN --mount=type=bind,from=<somageimage>,target/someimage was always read only but it's totally supported to pass rw to get a temporary overlayfs...and there's no good reason not to just require that really.