Let only the authority's root hold lines, refuse every line end, and keep places off the runtime's data and any .ssh

The review of hq issue 339 found the PEM exception too wide (any module, any
key, any label, anything base64), \v, \f, NEL and the Unicode separators
still let a value end a line in some readers, and the spool, /opt, the
container runtimes' data and an account's .ssh still placeable. Lines are now
taken only in step-ca's root setting, as certificates encoding/pem decodes and
x509 parses; every line end is refused; and those paths are the machine's own.
The test certificate is a real one, made for the tests with its key thrown away.

internal/catalogue/placement.go

@@ -54,18 +54,28 @@ var ownerShape = regexp.MustCompile(`^[0-9]+:[0-9]+$`)
 // before anything is kept or composed, and the node-engine refuses them again where it applies.
 //
 // systemTrees are refused at and below: the machine's system, the kernel's, the boot loader's, root's home,
-// what lives only while the machine runs, and the node-engine's and the mesh's own state. systemRoots are
+// what lives only while the machine runs, the spool (cron's tables are there), the container runtimes' data
+// (every container's filesystem), /opt, and the node-engine's and the mesh's own state. Any home's .ssh is
+// refused as well, wherever the home is. systemRoots are
 // refused at, and wherever a path holds one (an ancestor of /var/lib holds it): each is the parent of every
 // module's or every person's directories, and owning it is owning all of them.
 var (
 	systemTrees = []string{"/etc", "/usr", "/boot", "/root", "/run", "/var/run", "/var/lock", "/proc", "/sys",
-		"/dev", "/bin", "/sbin", "/lib", "/lib32", "/lib64", "/var/lib/mesh", "/var/lib/mesh-host"}
-	systemRoots = []string{"/", "/var", "/var/lib", "/var/cache", "/var/log", "/var/tmp", "/var/spool", "/home",
-		"/mnt", "/media", "/srv", "/opt", "/tmp", "/storage", "/data", "/services"}
+		"/dev", "/bin", "/sbin", "/lib", "/lib32", "/lib64", "/var/lib/mesh", "/var/lib/mesh-host", "/var/spool",
+		"/var/lib/docker", "/var/lib/containers", "/opt"}
+	systemRoots = []string{"/", "/var", "/var/lib", "/var/cache", "/var/log", "/var/tmp", "/home",
+		"/mnt", "/media", "/srv", "/tmp", "/storage", "/data", "/services"}
 )
 
 // systemPath says why a clean absolute path is the machine's own and never a placement's or an access's, or "".
 func systemPath(path string) string {
+	// Any home's keys, wherever the home is: a .ssh directory is its account's, and the keys and the list of who
+	// may log in as it are in there.
+	for _, part := range strings.Split(path, "/") {
+		if part == ".ssh" {
+			return path + " is an account's .ssh, which holds its keys and who may log in as it"
+		}
+	}
 	for _, tree := range systemTrees {
 		if path == tree || strings.HasPrefix(path, tree+"/") {
 			return path + " is in " + tree + ", the machine's own or the mesh's state"