…ayers so it can exclude the top-most level

Before, every docker image had three extra layers:

1. A `closure` layer which is an internal implementation detail of
   calculating the closure of the container
2. a `name-config.json` layer which is the images' run-time
   configuration, and has no business being *in* the image as a layer.
3. a "bulk-layers" layer which is again and implementation detail
   around collecting the image's closure.

None of these layers need to be in the final product.

Without changing behavior, since this code is fiddly, make it possible
to add a filtering step before packaging individual paths.

…l layers

…ion-detail-layers

dockertools.buildLayeredImage: remove implementation detail layers