runsc: When mounting a new procfs fails, fall back to recursive bind-mount.

[copybara-service]

runsc: When mounting a new procfs fails, fall back to recursive bind-mount.

As part of sandbox startup, runsc needs to set up a chroot environment
with a minimal working procfs filesystem mounted within. However, doing
so from within a container (as applications like Dangerzone do) may fail,
because in the container runtime's default configuration, some paths of the
procfs filesystem visible from within the container may be obstructed. This
prevents mounting new unobstructed instances of procfs.

This change detects this case and falls back to the previous behavior of
using a recursive bind-mount of /proc in such a case. The obstructed
subdirectories of procfs are preserved in this case, which is fine because
we only need a very minimal subset of procfs to actually work.

Additionally, runsc actually only needs a few kernel parameter files
and /proc/self in order to work. So this change sets up a tmpfs mount
that contains just those files, with the kernel parameter files being
plainly copied and /proc/self being a symlink to the one present in the
mounted view of procfs (regardless of which mounting method was used).

The runtime_in_docker test will continuously verify that this fallback
mechanism works to avoid similar breakage in the future.

Credits to @avagin for figuring out this solution.

Fixes #10944.