set up new mechanism for unlisted subcommands; implement up/destroy/exec/push/pull

For the build automation, there will be lots of subcommands that are meant to run in scripted environments. They are not intended for interactive use. Although they sometimes might be useful interactively, they might also sometimes be dangerous to run interactively because they rely on the presence of a VM/container, modify the local environment, or even run things as root. For that reason, they are not listed as subcommands in the help, etc.

This sets up the basic pattern for the new subcommands that are designed to provide an external API and an internal API:

• The external API is a set of subcommands to put used in a build management system like Buildbot, etc.
• The internal API is a pattern for implementing alternate virtualization methods for running the builds. This currently supports Vagrant (our current legacy setup) and Podman.

Open questions before merging this:

• standardize the push_wrapper convention in all subcommands with podman/vagrant?
• fdroid pull should only pull into unsigned/? What about extract_icons, fetch_metadata, etc?

Open questions that can be handled after merging this:

• Should virt_container_type be handled as config, args or both?
• CPU/Memory via config, args, or both?
• What should the standard logging output be?