krun: start render server if required

[slp]

So far, when VIRGLRENDERER_RENDER_SERVER was specified in gpu_flags, we
where using the /usr/libexec/virgl_render_server binary from the OCI.
It was started by the host's libvirglrenderer library (linked from
libkrun and, as such, running in the container's context) when the
virtio-gpu device was initialized.

This is convenient, because it allows the OCI to pack both the binary
and the libraries the render server requires, but meant running an
OCI-provided binary outside the microVM (but still within the container
context).

In 1.19.5, libkrun introduces the ability to provide a file descriptor
for an already running render server, allowing us to start the render
server ourselves.

This is still tricky, because we need to start the render server from a
context where it still has access to the host's vulkan libraries and
icds, but most distributions ship a virgl_render_server without
self-isolating capabilities, and we don't want to a render server
listening to guests commands and still having access to the whole host's
filesystem.

To address this, we run virgl_render_server through bwrap, which
provides a reasonable degree of isolation for this use case. Both
binaries must be present in the system for the render server to be
started. If either is missing, a descriptive error is returned to the
user.

For security reasons, instead of being backwards compatible, if an older
version of libkrun is present in the system, we reject enabling GPU
access.

[slp]

With this change, virgl_render_server is run from the host but inside the container context, just as we do with passt. This may pose some challenges with selinux, as in Fedora I need to run the container with --security-opt label=disable. But that's a problem at the distro level and not something we can't fix here.

The only thing we could do is running virgl_render_server outside the container context, but I'm honestly not comfortable proposing such option.

The latest iteration of this PR uses bwrap to run virgl_render_server still in the host context, but reasonably isolated.

[giuseppe]

I am fine with this, LGTM

is it still a Draft?

[slp]

is it still a Draft?

Yes, we're rewriting so it's crun the one starting virgl_render_server. I'll update the PR later today.