Allow to have the users and groups created in the immutable part of the composite setup

When running the Oak with Composite Node Store, the /home subtree is always stored in the mutable, global part. Therefore, even if we switch the immutable part (eg. /libs), the users and groups are not affected.

This setup makes sense for the users and groups created interactively. However, we also have the service users, which usually are not created interactively, but are part of the application and therefore are related to the /libs part. For such users, it'd make sense to include them dynamically, together with the application, read-only mount.

The proposal is to allow some part of the /home (eg. /home/service) to be mounted from the read-only partial node store. Let's consider the constraints we need to put in place (eg. it shouldn't be possible to have inter-mounts group memberships) and how we can implement this.