[ecs] [request]: Support /dev/net/tun Device in Fargate

**Tell us about your request**

Cloudflare made an excellent userspace implementation of the WireGuard VPN named [BoringTun](https://github.com/cloudflare/boringtun) which doesn't require a kernel module. I'd like to run BoringTun inside of a Fargate container so that I don't have to worry about paying for and managing VMs.

My goal is to provide a lightweight VPN that I can use for secure internet browsing when I'm traveling or to bypass corporate firewalls.

Since `--device` is not supported for the Fargate launch type, I am unable to use BoringTun in Fargate.

**Which service(s) is this request for?**

Fargate/ECS.

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

I want to be able to host a VPN in Fargate to support up to a few clients at a time. WireGuard is an excellent VPN implementation and BoringTun is a fully in-userspace implementation. It requires `CAP_NET_ADMIN` as well as `/dev/net/tun` to create the virtual interface.

Fargate does not support `device` mappings. I understand the security problems with device mappings, but if Fargate was able to allow only a small subset of devices, that would be extremely helpful and would solve my issue.

**Are you currently working around this issue?**

Unable to use Fargate.

**Additional context**

My `docker-compose.yml`:

```yaml
---
version: '3'
services:
missioncontrol:
build: .
image: naftulikay/missioncontrol:latest
container_name: missioncontrol
sysctls:
- net.ipv4.ip_forward=1
- net.ipv4.conf.all.rp_filter=2
cap_add:
- net_admin
ports:
- '22022:22'
- '51820:51820'
devices:
- /dev/net/tun
```

**Attachments**

c.f. the BoringTun issue I filed: https://github.com/cloudflare/boringtun/issues/69