XFS disk quota isolator

Implement a disk resource isolator using XFS project quotas. Compared to the posix/disk isolator, this doesn't need to scan the filesystem periodically, and applications receive a EDQUOT error instead of being summarily killed.

This initial implementation only isolates sandbox directory resources, since isolation doesn't have any visibility into the the lifecycle of volumes, which is needed to assign and track project IDs.

The build dependencies for this are XFS header (from xfsprogs-devel) and libblkid. We need libblkid or the equivalent to map filesystem paths to block devices in order to apply quota.