[tracking issue] deprecation of insecure --no-pivot flag

With https://github.com/opencontainers/runc/pull/4434, our pivot_root(2) code now works for the primary usecase for --no-pivot and so --no-pivot is now deprecated unless we find some new usecases that were not apparent before. pivot_root(2) is far more secure than chroot(2) (even with the hardenings we've added over the years).

Known users of --no-pivot:

• Kata Containers -- https://github.com/kata-containers/kata-containers/blob/3.9.0/src/agent/src/sandbox.rs#L148
• minikube -- https://github.com/kubernetes/minikube/blob/v1.34.0/pkg/provision/ubuntu.go#L69

If you found this issue from a warning printed by runc, please let us know more about your usecase in this issue (in particular, why do you use --no-pivot and does runc 1.2 without --no-pivot work for your usecase?).

Start with runc pull request #4434 and the two downstream call sites linked in the issue: Kata Containers' sandbox.rs and minikube's ubuntu.go. Check why each use case passes --no-pivot and whether runc 1.2 works without it. Done means recording any remaining use cases or confirming that no new use case blocks deprecation.