Implement sandbox shared PID namespace support about agent

[sboeuf]

This is going to be supported by starting a pause binary from the call to CreateSandbox(). This binary will be ForkExec() into a specific PID namespace we will choose the name of. This process will become the init(PID1) of this namespace. This way, we can start a bunch of containers into the same PID namespace without having this namespace being destroyed when some container processes terminate.

[laijs]

net/ipc/pid/uts are all suggested to be created for the sandbox init process.
And let the containers join in when requested. (net and uts ns are mandatory to join)

[laijs]

see #54

[sboeuf]

net namespace is a pretty complicated case...