[twimage] Support rootless for antlir2 CAF builds, take 2

Summary: Original in D59134440 was reverted -- I'd misunderstood how defaults would propagate via PACKAGE settings and this had the effect of essentially moving to a root requirement for every fbpkg which is... expectedly bad.

Test Plan:
On top of testing done in D59134440, confirm standard fbpkgs don't require root:
```
$ buck2 run @//mode/opt-clang -c caf.dev=1 instagram-server:instagram.distillery.opt -- -v
...
# no sudo warning
24-07-08T13:19:12.030153495-07:00  INFO separate_checkout: not using separate checkout because of killswitch: not using separate checkout due to env var
2024-07-08T13:19:12.030784573-07:00 DEBUG base_build_and_upload:build_archive:build_native_archive:run_build_cmd: registry_build_utils::base_local_build: Running build command: cd "/data/users/jtru/fbsource" && "buck2" "build" "fbsource//fbcode/mode/opt-clang" "-c" "antlir.rc_targets=//registry/builder/fbpkg:fbpkg-build" "-c" "bolt.disable=true" "-c" "build.threads=30" "-c" "build_info.host=devvm18238.vll0.facebook.com" "-c" "build_info.package_name=instagram.distillery.opt" "-c" "build_info.package_version=5c4687b17f9067c21141b4a27c979b96" "-c" "build_info.revision=ff634ef6de051235a8babef1fb3da5bd0b53cfc4" "-c" "build_info.re$ision_epochtime=1720468535" "-c" "build_info.target_path=fbcode//instagram-server:instagram.distillery.opt" "-c" "build_info.upstream_revision=60fe549243f196007b8ec460ff82007ae355a896" "-c" "build_info.upstream_revision_epochtime=1720463960" "-c" "build_info.user=jtru" "-c" "cxx.extra_cflags=-fno-unique-internal-linkage-names" "-c" "cxx.extra_cxxflags=-DUSE_NATIVE_LINK_STRATEGY" "-c" "cxx.extra_ldflags=-Wl,--discard-section=.stapsdt.base" "-c" "cxx.profile=fbcode//fdo/autofdo/instagram/server/native_python/native_python_ig_server_bolt:autofdo" "-c" "fbcode.distributed_thinlto_partial_split_dwarf=true" "-c" "fbcode.dwp=true" "-c" "fbcode.ignore_stale_profile_error=true" "-c" "fbcode.link_static_libpython3.10=True" "-c" "fbcode.platform=platform010" "-c" "fbcode.py_version=3.10.cinder" "-c" "fbcode.split-dwarf=true" "-c" "fbcode.xar_compression_level=16" "-c" "user.force_gvfs=true" "fbcode//instagram-server:instagram.distillery.opt[inplace_tree]" "--build-report=-"
Buck UI: https://www.internalfb.com/buck2/de552a02-6186-4f8f-9370-4e4faaaf7d06
```

Also confirm with cached binary for good measure:
```
$ fbpkg build //instagram-server:instagram.distillery.opt
...
# same outcome
```

Also check that CAF images use root still:
```
$ buck2 run mode/opt -c caf.dev=1 fbcode//tupperware/image/chronos/chronos:tupperware.image.sendstream.tangram.agent.chronos.basic.caf -- -v
...
2024-07-08T20:27:13.153724Z  WARN buck2::panic::imp: Warning "root_not_allowed": buck2 is not allowed to run as root (unless home dir is owned by root)
```

And regular non-image CAF builds still work:
```
$ buck2 run mode/opt -c caf.dev=1 fbcode//tupperware/image/base/impl/releases/centos9:tupperware.image.sendstream.base.c9
...
2024-07-08T20:36:52.634700Z  WARN buck2::panic::imp: Warning "root_not_allowed": buck2 is not allowed to run as root (unless home dir is owned by root)
```

Reviewed By: epilatow

Differential Revision: D59478889

fbshipit-source-id: c06a628d2f9cdff5142e129b569079caeb2c1f93

antlir/antlir2/antlir2_rootless/package.bzl

@@ -21,3 +21,6 @@ def antlir2_rootless(*, rootless: bool):
 
 def get_antlir2_rootless() -> bool:
     return _read_package_value(_KEY) or bool(int(native.read_config("antlir2", "rootless", 0)))
+
+def antlir2_rootless_config_set() -> bool:
+    return _read_package_value(_KEY) != None or native.read_config("antlir2", "rootless", None) != None