modify an OCI bundle rather than a whole new wrapper script

[AkihiroSuda]

https://github.com/projectatomic/buildah/issues/386#issuecomment-356171230

@cyphar:

@AkihiroSuda Have you considered making runrootless a tool that will modify an OCI bundle rather than a whole new wrapper script? In principle you would only need to touch the config.json since you also bind-mount PRoot into the container.

Yes, it should be easily possible. What do you expect for CLI UX?

Does runrootless _convert look fine?

(I prepended an underscore so that it won't conflict with future version of runc, but no strong opinion)