Support hooks modifying exec paramters

We currently wrap the runc binary in order to modify containers and exec commands. It'd be great to move to NRI, but NRI does not appear to support modifying `runc exec`. Modifying `runc exec` is useful for many reasons, here are some that we currently use in production:
- injecting exec-specific env vars, for example, modifying `PS1` to include information about which cluster you're in
- modifying the privileges of an executed process: for example, we allow admins to achieve the equivalent of `docker exec --user=root --privileged` via `kubectl` by prepending directive to the executed command like:
```console
kubectl exec -it -- EXEC_PRIVILEGED=true EXEC_USER=root bash
```
(We enforce who can prepend these directives via admission control)
- injecting a wrapper binary into the container for an exec command which:
- prints a MOTD with debugging information, cluster context, links to grafana charts, etc
- sets the loginuid of the process to the user's LDAP UID so that TTY events in the container are attributable to the user in auditd logs just as they would be in SSH on a traditional server
- injecting busybox into a container if it lacks a shell so that basic debugging can be performed without paging an admin with ssh access