This came out of some prep work on
ostreedev#69

Right now it's confusing, the layering code ended up re-implementing
the "fetch and unpack tarball" logic from the unencapsulation path
unnecessarily.

I think it's much clearer if the layering path just calls down
into the unencapsulation path first.

Among other things this will also ensure we're honoring the image
verification string.

I was doing some further reading of code and noticed we opened
the image multiple times.  I think that's not a big deal, we probably
will reuse connections to the registry etc. internally.  But fix
it anyways.