Defer release of slow-to-release FDs via disabled `io_uring` ring.

`runsc` creates some FDs that are slow to release (`AF_PACKET` sockets for
networking, KVM FDs for the KVM platform).
By releasing them asynchronously, we free up the sandbox process memory
earlier during teardown, allowing better density of sandboxes to exist.

Also allows faster sandbox recycling for systems like Substrate which spawn
a new sandbox as soon as one exits.

This uses an `io_uring` hack to move the release work to a kworker thread.
The ring is held by the gofer (not the Sentry), is disabled
(`IORING_SETUP_R_DISABLED`), and is unusable anyway due to seccomp filters.

Includes a test to verify this kernel implementation detail.

Benchmarks:

```
$ sudo runsc do --platform=kvm --network=sandbox

        │    before      │   after                              │
        │    sec/op      │   sec/op     vs base                 │
RunscDo     459.5m ± 6%     432.5m ± 4%  -5.88% (p=0.001 n=30)

           │     before       │   after                               │
           │     sec/op       │   sec/op     vs base                  │
OCICreate       155.8m ± 5%      155.0m ± 7%        ~ (p=0.623 n=30)
OCIDelete       8.838m ± 4%      7.713m ± 9%  -12.73% (p=0.000 n=30)
OCIExit        80.511m ± 6%      2.015m ± 7%  -97.50% (p=0.000 n=30)
OCIReady        170.6m ± 6%      171.0m ± 7%        ~ (p=0.708 n=30)
OCIStart        15.51m ± 3%      15.97m ± 5%        ~ (p=0.223 n=30)
OCITotal        261.0m ± 5%      180.8m ± 6%  -30.73% (p=0.000 n=30)
```