Cleanup CutFlowSvc: prevent writing to the metadata store directly

This is the first MR of substantial CutFlowSvc cleanup. The main change is not to write to the metadata store directly, but use a helper xAOD::CutBokkeeperContainer.

The other change is now that BookkeeperTool now also interfaces with the service directly to access some "private" methods that should not be used outside core metadata code.

I ran TEST1 and TEST2 derivations in a train and the output was unchanged.