Add os-brick rootwrap filter for privsep

Add os-brick rootwrap filter for privsep

This change adds the command required to start the os-brick privsep
privileged helper process.

This should be the last "routine" merge to rootwrap filters from
os-brick, since os-brick privileged operations will now go through the
privsep mechanism.  The now-obsolete os-brick rootwrap entries will be
removed in a followup change that also bumps the os-brick minimum
version appropriately.

Change-Id: I3b2e337321875cf4abc0ab9b44fe17cf9327d88b