I think I'm pretty happy with how it looks now and want start getting feedback.

This PR implements sandbox proposal described in #4131

Implementation goals:

• Keep existing task service compatible with sandboxed tasks. e.g. have sandboxes that are managed independently by clients, but keep existing task service compatible for both cases and use same API/services (the only difference is that container would need client.WithSandbox specified to assign container to a specific sandbox).
• Keep shim’s changes minimal. There are a few existing microVMs runtimes that I used as reference for the shim design. Existing task interface is pretty much sufficient. So the goal here was to extend, but don't change existing things (actually lots of them were contributed separately Decouple shim start from task creation #5336 Runtime cleanup #5368).

Summary of changes:

• Overall Sandbox API adds two new entities to containerd - 1) Sandbox (kin of Container), it describes sandbox state that can be saved to database. 2) Sandbox instance aka shim aka SandboxID (kin of Task, not exactly represented as entity, but rather as a runtime ID) - runtime representation of sandbox. Internally its backed by the runtime shim that implements sandbox extensions.
• metadata package. Adds sandboxStore to save/load Sandbox record from boltdb.
• runtime adds sandbox manager. It wraps existing task manager to manage shims. When Container has SandboxID field specified, sandbox manager will use this ID to look up for an appropriate shim instance to route request to. If it's empty, sandbox manager will route request to existing task manager, so existing behavior is preserved.
• shim optionally may implement SandboxService. If so, it'll register an additional TTRPC endpoint that containerd can talk to to manage sandbox instance.
• client adds Sandbox interface similar to Container client interface.

Client side example:

sandbox, err := client.NewSandbox(ctx, "sandbox-id-1",
	WithSandboxRuntime("runtime", shimOpts), // Select shim runtime and provide extra options via StartOpts.Options
	WithSandboxSpec(spec), // Sandbox spec to be written to bundle dir (currently allow arbitrary interface{})
	WithSandboxLabels(labels), // Labels to be added to store
)

// Start new sandbox instance
err = sandbox.Start(ctx)

// Now schedule tasks to this instance via
container, err := sandbox.NewContainer(ctx, "container-1", WithXYZ...)
// OR
client.NewContainer(ctx, "container-2", WithSandbox(sandbox.ID()), WithXYZ...)

// Same task service flow as usual
// ...

// Sandbox specific calls
err = sandbox.Status(ctx, out)
err = sandbox.Ping()
err = sandbox.Pause(ctx)
err = sandbox.Resume(ctx)

// Kill everything and shutdown sandbox instance
err = sandbox.Shutdown(ctx)

Shim side: b564c33

There are a few remaining bits left - client examples, publish proper events, more test coverage, integrations tests, etc. However I'd like to gather feedback on the overall design/implementation.