Refactor qemu emulator loading to use seccomp hook

When emulators are needed for building multi-platform images they usually need to be installed in kernel. That is not ideal as we force the user to reconfigure their whole machine.

If kernel does not have emulators installed we use the embedded emulators built in https://github.com/tonistiigi/binfmt#buildkit-target . These have special patches that allow them to be invoked directly instead of loaded by the kernel. We pick the correct emulator, mount it inside container, and change the entrypoint to go through the emulator. Patches inside the emulator ensure that when emulated process calls exec() it is not invoked directly but by the same emulator.

This mostly works but has a limitation that all binaries inside container need to be for the same architecture, while when using kernel it allows mixing binaries.

Instead of changing the entrypoint we could use a different method. We could launch the container with a seccomp hook that gets called on every execve(2) invocation. Then we would see what emulator is needed for a specific binary and change call to go through the emulator(that we have mounted inside the container) instead.

This assumes that there will be no performance regression from handling these seccomp hooks. To be determined how practical it is in reality.

@AkihiroSuda @tiborvass

No files, tests, or entry points are named. Start by locating the current embedded-emulator loading and entrypoint handling, then investigate the seccomp hook approach and its performance implications; done should support mixed-architecture binaries without requiring kernel-installed emulators.