- Pre-create /var/lib/container with a secure mode (0700) via tmpfiles.d.
 - Add new try-{guest,host} modes for --link-journal to silently skip
   setting up the guest journal if the host has no persistant journal.
 - Extend boot-and-services autopkgtest to cover systemd-nspawn@.service.

Patch cherry-picked from upstream git.

Closes: #770275