[REFACTOR]: consolidate filesystem ops into internal pkg

[apostasie]

This suggests that we consolidate low-level filesystem related operations into one package (currently pepperred over under lockutil and store).

This includes path validation, atomic writes, locks.

Also suggesting that said package should be made internal. This is not nerdctl API, but merely low-level primitives, and generally speaking the nerdctl API is just too big, exposing too much irrelevant stuff.

This refactor is in preparation for future PRs that will focus on:

• enhancing locks to be more flexible and allow locking of files AND dirs, and also allow for RO locks
• enhancements to atomic writefile to support in-place writing (current rename approach does change inode), with a rollback / disaster recovery mechanism
• consistently use atomic writes to ensure better resilience and data consistency
  (they will be broken out of [FUTURE] [EXP] filesystem package #4240 as well in small chuncks)

This PR here sticks with purely refactoring.