Networking: implement traffic shaping (throttle/rate limit) directly in gVisor

### Description

Hello 👋

I'm wondering if it is technically possible to implement traffic shaping **directly** in the gVisor sandbox, and not rely on external tools (like `tc`) to restrict both ingress and egress bandwidth of containers. I have been reading the [networking architecture guide](https://gvisor.dev/docs/architecture_guide/networking/), and the sentry/netstack abstraction makes me think it could be possible, since all packets seems to go through the virtual interface. Also I've already seen some `qdisc` references in the [code](https://github.com/google/gvisor/blob/release-20241028.0/pkg/tcpip/link/qdisc/fifo/fifo.go). I am not a networking expert though, so maybe I'm just writing absolute nonsense; feel free to correct me if so.

Anyway, my use-case is very simple: I want to run multiple containers using `runsc`, but **easily** restrict/throttle/rate-limit both **transmitted** and **received** bytes rate to something like 10 MB/s for each container, without having to tweak my host. This use-case can also apply in more high level tools like Kubernetes. There are some ways to do traffic shaping in a K8s cluster ([bandwidth CNI plugin](https://www.cni.dev/plugins/current/meta/bandwidth/), [cilium bandwidth manager](https://docs.cilium.io/en/v1.16/network/kubernetes/bandwidth-manager/), ...) but I have not been able to make it work with gVisor though.

Despite having a very different approach when it comes to sandboxing, [Kata containers](https://github.com/kata-containers/kata-containers) have [implemented this feature](https://github.com/kata-containers/kata-containers/pull/312), and it is as simple as setting `rx_rate_limiter_max_rate` and `tx_rate_limiter_max_rate` parameters in the configuration. So, I would expect ingress/egress rate limit to be as simple as passing a flag to the `runsc` command.

Again, I don't know if what I am asking is possible, and whether there are easy alternatives that could already fulfill the bandwidth rate limiting feature. Any pointers would be appreciated.

Thanks 😃

### Is this feature related to a specific bug?

No.

### Do you have a specific solution in mind?

Not really sadly 😕 I'm assuming this behavior could live in the [`qdisc` "algorithm"](https://github.com/google/gvisor/blob/release-20241028.0/pkg/tcpip/link/qdisc/fifo/fifo.go) where packets are dispatched, or in the [`netstack` abstraction](https://github.com/google/gvisor/tree/release-20241028.0/pkg/sentry/socket/netstack), but these are just wild guesses as I'm not an expert of how gVisor works under the hood (especially the networking part).