packages: Add minimal-jail set

[ivy]

Summary

This is minimal, but without bootloader, hardware and networking support
that's typically not required in jails.

This requires extending the 'set' annotation to be a comma-separated
list, so that packages can be in multiple sets.

MFC after: 3 days

[ivy]

this is a proof-of-concept for jail sets, so there's only one for now; we can add more later.