Related work items: microsoft#1062, microsoft#1087, microsoft#1089, microsoft#1095, microsoft#1104, microsoft#1112, microsoft#1117, microsoft#1118, microsoft#1125, microsoft#1137, microsoft#1139, microsoft#1140, microsoft#1141, microsoft#1142, microsoft#1143, microsoft#1145, microsoft#1146, microsoft#1150, microsoft#1151, microsoft#1153, microsoft#1154, microsoft#1155, microsoft#1156, microsoft#1157, microsoft#1158, microsoft#1159, microsoft#1161, microsoft#1162, microsoft#1163, microsoft#1164, microsoft#1165, microsoft#1166, microsoft#1167, microsoft#1168, microsoft#1169, microsoft#1171, microsoft#1172, microsoft#1173, microsoft#1174, microsoft#1178

This is the first iteration of policy enforcement at unmount. There is an additional set
of functionality that will come as part of a larger change in the near future.

With this commit, we record that a device has been unmounted such that it isn't eligible to
be used in any overlay after unmounting.

In a future commit, I will be adding disallowing unmounting a device that is being used by a
running container.

Signed-off-by: Sean T. Allen <seanallen@microsoft.com>