logging: Use RotatingFileHandler to trim logfile at 5MB

Remove all direct uses of args.logfd: everything goes through the logger now.

Only the container manager process is allowed to write to the log, which now
has 0o644 permissions.

Other commands will only log to stdout. Logs that would previously appear
in the logfile will now only be visible with --details-to-stdout.