container workloads with /proc/sys ro mount are problematic

[cyphar]

Our /proc/sys/fs/protected_symlinks emulation logic with the O_PATH resolver errors out if you are in a container with /proc/sys overmounted as RO. I think there are two steps to fixing this:

1. As a hotfix, if getting the sysctl value errors out we err on the conservative side and assume it is enabled.
2. Figure out a way to permit overmounts if they are of the same path (and possibly only permit certain mount flags to be set). We can probably do this with statmount on newer (6.8) kernels? On old kernels we will need to parse mountinfo. Not sure if it's worth it. :/

[cyphar]

Based on some comments in https://bugzilla.redhat.com/show_bug.cgi?id=2449216 our tests also have issues when running in containers (I think Fedora uses nspawn or vmspawn?), so we should have a container-based test run in our own CI to catch stuff like this...

[buckaroogeek]

As an FYI, Fedora mock uses nspawn.