(core) add gvisor-based sandboxing to core

Summary:
This adds support for gvisor sandboxing in core. When Grist is run outside of a container, regular gvisor can be used (if on linux), and will run in rootless mode. When Grist is run inside a container, docker's default policy is insufficient for running gvisor, so a fork of gvisor is used that has less defence-in-depth but can run without privileges.

Sandboxing is automatically turned on in the Grist core container. It is not turned on automatically when built from source, since it is operating-system dependent.

This diff may break a complex method of testing Grist with gvisor on macs that I may have been the only person using. If anyone complains I'll find time on a mac to fix it :)

This diff includes a small "easter egg" to force document loads, primarily intended for developer use.

Test Plan: existing tests pass; checked that core and saas docker builds function

Reviewers: alexmojaki

Reviewed By: alexmojaki

Subscribers: alexmojaki

Differential Revision: https://phab.getgrist.com/D3333

stubs/app/server/lib/create.ts

@@ -1,9 +1,6 @@
 import {ActiveDoc} from 'app/server/lib/ActiveDoc';
 import {ICreate} from 'app/server/lib/ICreate';
-import {NSandboxCreator} from 'app/server/lib/NSandbox';
-
-// Use raw python - update when pynbox or other solution is set up for core.
-const sandboxCreator = new NSandboxCreator({defaultFlavor: 'unsandboxed'});
+import {createSandbox} from 'app/server/lib/NSandbox';
 
 export const create: ICreate = {
   Billing() {
@@ -28,7 +25,7 @@ export const create: ICreate = {
   ExternalStorage() { return undefined; },
   ActiveDoc(docManager, docName, options) { return new ActiveDoc(docManager, docName, options); },
   NSandbox(options) {
-    return sandboxCreator.create(options);
+    return createSandbox('unsandboxed', options);
   },
   sessionSecret() {
     return process.env.GRIST_SESSION_SECRET ||