[ECS] [request]: ECS Exec with userns-remap

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

We use Docker [user namespace remapping](https://docs.docker.com/engine/security/userns-remap/) to isolate containers and reduce the risk of privilege-escalation. However, this breaks the amazon-ssm-agent and prevents the use of ECS Exec.

One reason this happens is the amazon-ssm-agent executables and config files, which are owned by root on the host, are bind-mounted into containers. On startup, the agent checks these files to determine if it should use them, but it [requires they be owned by root (UID 0, GID 0)](https://github.com/aws/amazon-ssm-agent/blob/5e40f04891e46dd7bfd37144d03a8eff42e91965/agent/appconfig/constants_unix.go#L206-L211), but with the UID/GID remapping, they will be owned by the first subordinate UID/GID instead. I've tried to work around this by `chown`ing everything in `/var/lib/ecs/deps/execute-command` to the first subordinate UID/GID so that the files look like they are owned by root in the container, but the ECS agent appears to generate new config files for each container which are owned by root.

Start with ECS Exec's amazon-ssm-agent bind mounts and the generated configuration under /var/lib/ecs/deps/execute-command. Read the referenced constants_unix.go ownership check and reproduce it with Docker user namespace remapping; done means the agent starts and ECS Exec works while remapping remains enabled.

Written by the indexing model from the issue text.