This fixes a variety of small bugs in layer handling and adds a new API for acquiring privileges for the whole process. Fixes #22404 (but only for new images -- existing images will need to be re-pushed). Signed-off-by: John Starks <jostarks@microsoft.com> Upstream-commit: 6d40104f116abdf9740c60846320ce6d36f03edd Component: engine