Make the bwrap alias a wrapper around the sandboxexec Go bindings.

bwrap previously built its own specs.Spec, wrote an OCI bundle and drove runsc/container directly. It now only parses the bubblewrap command line and translates it into sandbox.Options; //sandboxexec/sandbox owns the bundle, the runsc invocation and the container lifecycle.

To support this, the bindings gain:
- Run, an attached counterpart to New that runs a command to completion over `runsc run`, preserving its stdio and exit code, and relaying signals into the container via `runsc kill`.
- Options for the process, rootfs, namespaces, ID mappings and mount options bwrap needs, plus opt-outs for the bindings' default mounts, host binary mounts and base environment. Every zero value reproduces the previous bundle layout.
- Config, which resolves options into a BundleConfig for testing.
- runsc stderr in the failure message from New, instead of a bare exit status.

Signal relaying skips SIGURG, SIGPIPE and SIGCHLD as pkg/sighandling does; relaying SIGCHLD would be self-sustaining, since each forwarded signal spawns a runsc process whose exit raises another.

Behavior deltas: bwrap now forks a runsc process, passes --ignore-cgroups when not root, and roots a container with no `--bind / /` at the bundle's rootfs directory rather than a separate temporary directory.

FUTURE_COPYBARA_INTEGRATE_REVIEW=#14022 from milantracy:bwrap 24a225e
PiperOrigin-RevId: 960524302

Author: milantracy

runsc/cmd/alias/bwrap/BUILD

@@ -15,12 +15,11 @@ go_library(
         "//:__subpackages__",
     ],
     deps = [
-        "//pkg/log",
         "//runsc/cmd/util",
         "//runsc/config",
-        "//runsc/container",
         "//runsc/flag",
         "//runsc/specutils",
+        "//sandboxexec/sandbox",
         "@com_github_google_subcommands//:go_default_library",
         "@com_github_opencontainers_runtime_spec//specs-go:go_default_library",
         "@org_golang_x_sys//unix:go_default_library",
@@ -32,6 +31,8 @@ go_test(
     srcs = ["bwrap_test.go"],
     library = ":bwrap",
     deps = [
+        "//runsc/config",
+        "//sandboxexec/sandbox",
         "@com_github_google_go_cmp//cmp:go_default_library",
         "@com_github_google_go_cmp//cmp/cmpopts:go_default_library",
         "@com_github_opencontainers_runtime_spec//specs-go:go_default_library",