MCP tools should run in a container

That way you can easily restrict the filesystem access to the cwd of the MCP server.

This would also allow multiple MCP instances to share the same VM because they would run in separate containers.

And eventually it would make it easier to force all network traffic through a filtering proxy, to restrict where it can connect to (when e.g. a `web_search` tool is added). https://github.com/coder/httpjail looks like an interesting project for this, as it allows proxy filtering rules to be written in shell and JavaScript.

As an extension there could be a `--mount` option to allow access to additional directories for just this container (`--mount "$PWD"` would be implicit):

```
limactl mcp serve --mount ~/go
```

One challenge is of course that this requires downloading a container image on first use, so maybe this should be optional?

Another extension idea: add an `--image` option to specify a custom container image where the user may have project-specific tools already pre-installed.