feat: temporarily remount read-only mounts before cleaning container fs

[johnstcn]

This PR is a continuation of @janLo's original PR https://github.com/coder/envbuilder/pull/51 with some additional changes:

• Brings original PR up to date with latest main
• Moves the temp-remount logic into a separate package
• Refactors for ease of testing and adds unit tests

Manual verification:

• (Existing behaviour): On Docker runtime, dockerd fails to start after running:

  docker run -it --rm \     
    -e GIT_URL=https://github.com/coder/envbuilder \                     
    -e INIT_SCRIPT=bash \
    ghcr.io/coder/envbuilder:latest

• (New behaviour): Using sysbox-runc runtime*, dockerd starts succesfully:

  docker run -it --rm \     
    -e GIT_URL=https://github.com/coder/envbuilder \                     
    -e INIT_SCRIPT=bash \
    envbuilder:latest # local built image

• Existing sample devcontainer builds successfully on Docker runtime:

  docker run -it --rm \     
    -e GIT_URL=https://github.com/coder/envbuilder-starter-devcontainer \                     
    -e INIT_SCRIPT=bash \
    envbuilder:latest # local built image

* Lima config used: https://gist.github.com/johnstcn/b9d6854b3aedb551af1a7588e2a5af94