Support systemd IPAccounting or alternative

### Description

gvisor supports [IO/CPU/Memory accounting](https://github.com/google/gvisor/blame/bb4410f44e3291f7aa34a2655cd683cac7d149cb/runsc/cgroup/systemd.go#L108) but does not support IP accounting, which is enabled by the `org.systemd.property.IPAccounting: true` annotation.

We currently use `IpAccounting` in `runc` to measure container network usage. In an attempt to get IPAccounting working in `runsc` I hardcoded the systemd property:

```diff
diff --git a/runsc/cgroup/systemd.go b/runsc/cgroup/systemd.go
index f2eecd6d7..cdd2b912d 100644
--- a/runsc/cgroup/systemd.go
+++ b/runsc/cgroup/systemd.go
@@ -106,6 +106,7 @@ func (c *cgroupSystemd) Install(res *specs.LinuxResources) error {
c.addProp("CPUAccounting", true)
c.addProp("TasksAccounting", true)
c.addProp("IOAccounting", true)
+ c.addProp("IPAccounting", true)
// Delegate must be true so that the container can manage its own cgroups.
c.addProp("Delegate", true)
// For compatibility with runc.
```

But this was not sufficient. `systemd` will report zero values for IP metrics even when network activity is occuring.

I think this is because gvisor [implements its own network stack](https://gvisor.dev/docs/user_guide/networking/). The IO activity of the sandboxed process is visible to systemd but not its network activity.

As expected, setting the `"--network=host"` flag does allow systemd to report accurate network metrics:

```
systemctl status container-DJ2KZVgPXCI.scope
● container-DJ2KZVgPXCI.scope - Secure container DJ2KZVgPXCI
Loaded: loaded (/run/systemd/transient/container-DJ2KZVgPXCI.scope; transient)
Transient: yes
Active: active (running) since Mon 2023-09-11 02:59:16 UTC; 19s ago
IP: 989.5K in, 5.1K out
IO: 0B read, 2.4M written
Tasks: 47 (limit: 37868)
Memory: 24.5M (low: 1.0G)
CPU: 386ms
CGroup: /modal.slice/container-DJ2KZVgPXCI.scope
├─3976543 /var/tmp/runsc -platform=systrap -systemd-cgroup --network=host -file-access=shared -host-uds=open -overlay2=none -directfs -debug-log=/tmp/runsc/ ->
├─3976560 runsc-gofer --overlay2=none --platform=systrap --directfs=true --root=/run/user/1000/runsc --debug=true --debug-log=/tmp/runsc/ --strace=true --systemd-cgroup=true>
├─3976565 runsc-sandbox --file-access=shared --overlay2=none --host-uds=open --network=host --strace=true --directfs=true --root=/run/user/1000/runsc --debug=true --systemd->
├─3976596 [exe]
├─3976597 [exe]
├─3976655 [exe]
├─3976656 [exe]
├─3976657 [exe]
├─3976659 [exe]
├─3976663 [exe]
├─3976664 [exe]
├─3976665 [exe]
├─3976666 [exe]
├─3976668 [exe]
└─3976669 [exe]
```

But obviously having a network metrics gathering solution that doesn't involve exposing containers to the host network is desired.

### Is this feature related to a specific bug?

_No response_

### Do you have a specific solution in mind?

_No response_