Make self-backed rootfs overlay the default configuration for runsc.

This changes means that by default, runsc containers will be started with a
sentry-internal overlay on the container root filesystem. The volumes (bind
mounts) are not overlayed. Changes to volume locations from inside the
container will be visible on the host (as before).

This is a performance optimization. Having the overlay in the sentry allows
us to create/modify the filesystem without having to make round trips to the
gofer. Container workloads that mutuate the root filesystem a lot can expect
to see a performance improvement.

k8s may scan the container rootfs on the host to impose size limits. To ensure
that works correctly, the "self" overlay medium creates a filestore file in the
the container rootfs on the host which backs all the file data from the overlay
upper layer.

If this change breaks you, please let us know via GitHub Issues. To unbreak,
use --overlay2=none.

The following use cases do not work by default now:
1. The container root filesystem changes will not be visible from the host.
   This should be fine because container rootfs changes are destroyed with the
   container and is only accessed from within the container. But if for some
   reason, you want to access container rootfs from the host, please disable
   --overlay2. Same for users of --file-access=shared.
2. Save/restore is currently not supported with this. We are not aware of any
   S/R runsc users. If you do use S/R, please disable --overlay2.

PiperOrigin-RevId: 514872055

runsc/config/config.go

@@ -688,7 +688,8 @@ type Overlay2 struct {
 }
 
 func defaultOverlay2() *Overlay2 {
-	return &Overlay2{}
+	// Rootfs overlay is enabled by default and backed by a file in rootfs itself.
+	return &Overlay2{RootMount: true, SubMounts: false, Medium: "self"}
 }
 
 // Set implements flag.Value.