Enable migrating gVisor bwrap to go bindings

### Description

See [this TODO](https://github.com/google/gvisor/blob/8c502bc222fe7e1795b29c0da18fff83c9d7df4f/runsc/cmd/alias/bwrap/bwrap.go#L53): bwrap.go in gVisor currently creates an OCI configuration then runs that with gVisor. Eventually we want to migrate to using the Go SandboxExec bindings which similarly create an OCI configuration.

The current gaps:

- [ ] user namespace handling
- [X] Mount support PR #13574
- [X] setting env vars PR #13723
- [X] specify directory PR #13771
- [X] assigning a custom host name PR #13856
- [X] /proc mount support PR #13856

### Is this feature related to a specific bug?

_No response_

### Do you have a specific solution in mind?

_No response_