Support V3 containerd task service and Sandboxers

In containerd 1.7 the v3 task service was introduced.
In v3 both ttrpc and grpc are supported, choosing what RPC to use should definitely take into account memory overhead.

There's no real rush here, but V3 does buy us some simplified logic in bootstrapping the shim and support for "sandboxer" services.

"Sandboxer" can do a number of things, the immediate benefit is we don't have to have this logic that guesses that the first container sent to the shim (with a cri label) is actually the "pause" container.
Instead it leaves that implementation detail up to the sandboxer.
It would also make the "shared" mode as described in our readme a first class citizen.

Related:
- https://github.com/containerd/containerd/pull/9233
- https://github.com/containerd/containerd/pull/6703
- https://github.com/containerd/containerd/pull/8268
- https://github.com/containerd/containerd/pull/7228