How to patch CVEs and upgrade gVisor / microVM version used by SandboxConfig?

Some thoughts on this when working on Actor Upgrades (https://github.com/agent-substrate/substrate/issues/477):

* Upgrading gVisor or microVM means that the Actor's previous memory snapshot is not going to be usable. ResumeActor with new runsc version must use a new golden memory snapshot (or cold boot). Therefore, each ActorTemplateVersion must specify the exact SandboxConfig it uses, and the config must remain imutable.

* Different persona that manages SandboxConfig and ActorTemplate (the deployment). Although the memory snapshot means that "SandboxConfig" impacts the lifecycle of Actors. The configuration of "which runsc binary to use" belongs to the Platform Engineer layer, where as "ActorTemplate" belongs to the Agent Developer layer. Today in substrate we have a cluster-wide default SandboxConfig, which decouples it away from the ActorTemplate definition, and I think it makes sense from a Actor Developer's perspective. Having to define the exact CHV version that the AT runs on is not a good user experience.