Pass the containerCgroup to the sandbox object instead of parent.

This is a bug reported by #8311. It affects sandboxes where
containerCgroup != parentCgroup.

PiperOrigin-RevId: 498443910

runsc/container/container.go

@@ -283,7 +283,7 @@ func New(conf *config.Config, args Args) (*Container, error) {
 				UserLog:              args.UserLog,
 				IOFiles:              ioFiles,
 				MountsFile:           specFile,
-				Cgroup:               parentCgroup,
+				Cgroup:               containerCgroup,
 				Attached:             args.Attached,
 				OverlayFilestoreFile: overlayFilestoreFile,
 			}