add socket activation support for containerd

**What I'd like:**
Pods and tasks may bind-mount the container runtime socket for various reasons, such as gathering metrics. If containerd is restarted, that socket will no longer be usable, as the underlying file descriptor has been removed and created.

With socket activation, systemd would create the socket and pass the file descriptor into containerd at startup. This decouples the socket's lifetime from the service's, so the socket would continue to be valid even if the service is restarted.

**Any alternatives you've considered:**
Applications that need the socket should be written to fail and restart if the socket stops working.

However, this may not always be straightforward to implement. Applications might keep track of a number of different sockets, or call out to a helper program to handle the query, and might not correctly handle an error that would be seen only rarely.

No files, tests, or entry points are identified in the issue. Start by locating the containerd service configuration and how its runtime socket is created, then determine how systemd socket activation would pass that socket through. Done means the socket remains usable for bind-mounted consumers across a containerd restart.

Written by the indexing model from the issue text.