If a port should be exposed the container must provide it.

it is seen as bad idea from systemd side to have KillMode set to none - also with more recent podman versions we have background processes that stay around like that

If a pod file contains
```Yaml
spec:
  restartPolicy: Always
  containers:
    - image: 'django:latest'
```
the update script won't update this image.
Now it will find those images too and update them.

a) if a container volume is using Z it requires podman to be able to
   relabel the content of the volume first and thus it needs to
   be writable by podman. Podman will make it readonly within the
   container.
b) add possibility to require mountpoints so the units get started
   in the proper order.

manage seltypte so it works even if the package is not yet there with the seltype - installed in the same run

also allow /proc to be writable - which makes it possible for newuid... to create necessary files after a rboot from within the systemd, otherwise it only works once you executed podman outside of systemd

it was not an ordering issue, as tried to be fixed in the previous
commit, but rather a permission issue if the files did not yet exist