Support sandbox for Agent & RL

[k82cn]

Motivation

Currently, Flame only support WASM and Host runtime. The host runtime is ok for testing and hpc workload, e.g. training; the WASM runtime works for some specific WASM case. For Agent and RL, we'd like to introduce a sandbox runtime for both flexibility and safety. This feature will introduce a sandbox runtime, e.g. firecracker or gvisor, including snapshot.

Function Specification

1. In flame-cluster.yaml, support firecracker or giver shim
2. No api change

Solutions

Add a shim for sandbox, e.g. firecracker or gvisor

Additional context

N/A