Add GOARCH as config key to seccomp filter options.

This ensures that we cannot accidentally load rules that were compiled for
one CPU architecture onto another architecture. With this change, if this
happens, we'll ignore the precompiled rules and generate them at container
startup instead.

(Prior to this change, this could have happened for example if the `runsc`
binary had been cross-compiled, with the rules generation binary compiled
for a different architecture than the `runsc` target architecture.)

PiperOrigin-RevId: 585835885

runsc/boot/filter/config/config.go

@@ -19,6 +19,7 @@ package config
 import (
 	"fmt"
 	"os"
+	"runtime"
 	"strings"
 
 	"golang.org/x/sys/unix"
@@ -55,6 +56,7 @@ func isInstrumentationEnabled() bool {
 // at runtime (e.g. `ControllerFD`).
 func (opt Options) ConfigKey() string {
 	var sb strings.Builder
+	sb.WriteString(fmt.Sprintf("GOARCH=%q ", runtime.GOARCH))
 	sb.WriteString(fmt.Sprintf("Platform=%q ", opt.Platform.ConfigKey()))
 	sb.WriteString(fmt.Sprintf("HostNetwork=%t ", opt.HostNetwork))
 	sb.WriteString(fmt.Sprintf("HostNetworkRawSockets=%t ", opt.HostNetworkRawSockets))