Implement GPU passthrough functionality to provide hw-acceleration to inner-containers

Our goal here is to allow Sysbox container hierarchies to make use of hardware-acceleration capabilities offered by system devices. Device 'passthrough' is a concept that applies naturally to system-containers, and as such, it has been on our mind since Sysbox's early days, but it recently came up as part of a conversation with @jamierajewski (thanks for that).

A couple of scenarios where this would be useful:

• Development environments: A sysbox container would wrap inner containers with GUI requirements.
• K8s environments: A sysbox container could act as a K8s node and have PODs running apps with GUI demands.

Even though most of the concepts described here are applicable to any GPU, we will limit the scope of this issue to Nvidia GPU's; let's create separate issues for other GPUs.

At high-level, these are some of the requirements that Sysbox would need to meet:

• Sysbox should identify the GPU devices in the host and expose them automatically to the sysbox containers (through 'devices' oci-spec attribute).

• Sysbox should provide a mechanism that allows cuda-toolkit and related nvidia tools, which are required at host-level, to be shared (bind-mounted?) with sysbox containers. This would address two problems:

  1. Cuda-toolkit and drivers installed within sysbox containers must fully match those installed in the host (end-user wouldn't know which version to fetch at image build-time).
  2. Cuda packages are quite large, which would bloat sysbox images.

• Sysbox should allow proper execution of the nvidia-container-runtime within the system-containers, which should expose all the required abstractions for nvidia-runtime to operate as if it were running in the host.

This list of requirements will obviously change as we further understand the problem.