config: Handle -atoms properly

config: Handle -atoms properly

Before this change -atoms could leak out of the place where they were defined.
Different repos could influence their profile/package.mask.
Profiles could influence profile/package.mask.
Note that the latter is not desirable because other than normal atoms, -atoms
have to exactly match the atom they remove. Because of this, the place specifying
the -atom has to now which atoms exists, which can only be the case if it (or in case
of a profiles, a parent profile) defines it.