Hermetic builds should start a VM instead of a container

[Conan-Kudo]

Truly hermetic builds require complete isolation from the host, including removal of the influence of the host kernel and system properties. In order to do so, Mock needs to learn how to boot up a lightweight virtual machine, similar to what obs-build does in this scenario (and to note, this is the default for obs-build).

This would essentially mean adding a third runtime backend (in addition to simple and nspawn) for KVM, and maybe also a fourth one for plain QEMU (for foreign arch builds).

The code from obs-build is fairly straightforward:

• KVM: https://github.com/openSUSE/obs-build/blob/master/build-vm-kvm
• QEMU: https://github.com/openSUSE/obs-build/blob/master/build-vm-qemu

This would also resolve several problems we have with container-based builds where host properties leak and break things (like #952, #691, #1100, #1222, #1487, #1554, and so on).