Use containers/common for seccomp handling

[saschagrunert]

This change introduces the new dependency containers/common, which
mainly conains the logic from libcontainer/seccomp. We're also now able
to completely remove the internal Seccomp type and only rely on the
runtime-spec. The only visible API is now internal only (see
internal/seccomp).

Fixes #2565

PTAL @rhatdan @mrunalp @AkihiroSuda @kolyshkin

[saschagrunert]

cc @cyphar

[kolyshkin]

Not sure why so much changes in here... have you tried go mod tidy?

[saschagrunert]

Yes, go mod tidy does not change anything inside go.sum.

[kolyshkin]

LGTM overall, and kudos for using internal/!

[cyphar]

This would probably need a rewrite given #2750.

[cyphar]

I'm also slightly concerned about this PR because it's changing the serialisation format of the Config structure -- which is stored as part of the state (and thus this will cause problems with runc upgrades -- we made this mistake before with initProcessTime).

[saschagrunert]

I'm also slightly concerned about this PR because it's changing the serialisation format of the Config structure -- which is stored as part of the state (and thus this will cause problems with runc upgrades -- we made this mistake before with initProcessTime).

Ah yeah so I guess we cannot remove the internal types in an easy way. I'm closing for now and will revisit later.

[cyphar]

Yeah in the long-term we should work on removing the really ugly libcontainer serialisation but unfortunately for now it is needed and changing it has caused some /lovely/ bugs in the past.