Implement key management (keyctl and friends)

This is a currently unhandled piece of Linux functionality that we just "let through". But it introduces nondeterminism in the `key_serial_t` identifiers that come back.

Basic plan:

- virtualize the key serials just like with other IDs (e.g. inodes)
- make sure that our container setup keeps the process tree's keys separate from anything else on the system

Specific steps for virtualizating IDs would include:

- [ ] add a new global state RPC for adding/resolving key serial numbers
- [ ] have local handlers for add_key establish the new virtual mapping, and return the virtual serial ID to the guest, which probably starts at a constant and counts up by +1
- [ ] have request_key and keyctl calls resolve virtual serial numbers before issuing to Linux

### Relevant manpages:
- [keyrings generally](https://man7.org/linux/man-pages/man7/keyrings.7.html)
- [keyctl](https://man7.org/linux/man-pages/man2/keyctl.2.html)
- [add_key](https://man7.org/linux/man-pages/man2/add_key.2.html)
- [request_key](https://man7.org/linux/man-pages/man2/request_key.2.html)
- [wrapper CLI keyctl command](https://linux.die.net/man/1/keyctl)