Support OCI runtime spec #5
Description
sandlock supports Docker images as input, but isn't an OCI runtime. Implementing the OCI runtime spec interface would let it slot into Kubernetes as a RuntimeClass, which is the main adoption path for production workloads where gVisor dominates.