modify an OCI bundle rather than a whole new wrapper script

[AkihiroSuda]

containers/buildah#386 (comment)

@cyphar:

@AkihiroSuda Have you considered making runrootless a tool that will modify an OCI bundle rather than a whole new wrapper script? In principle you would only need to touch the config.json since you also bind-mount PRoot into the container.

Yes, it should be easily possible.
What do you expect for CLI UX?

Does runrootless _convert look fine?

(I prepended an underscore so that it won't conflict with future version of runc, but no strong opinion)