Go-runtime uses PROT_NONE mappings as place holders for future read-write
mappings.
However, we need to patch kernel otherwise we will get -EPERM (see arch/riscv/kvm/mmu.c)

Inherited FDs can cause conflict while remapping stdio FDs to startingStdioFD
and beyond. It can also cause failures in validateOpenFDs() which ensures no
directory FDs are open.

It is also better from a security perspective to not mistakenly leak file
descriptors from parent to the sandbox process.

Fixes #10232

PiperOrigin-RevId: 622032875

This is done to allow re-mapping of container IDs after the
container has been restored. Upon restore, container names
remain the same, but container ID may be (and likely are)
different.

Updates #1956

PiperOrigin-RevId: 621996848

GRO is getting moved and updated. This removes it in preparation for a
follow-up CL.

PiperOrigin-RevId: 621984030